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Abstract:  About  3:45  a.m.,  eastern  daylight  time,  on  July  14,  2001,  at  the  ATOFINA  Chemicals,  Inc., 
(ATOFINA)  plant  in  Riverview,  Michigan,  a  pipe  attached  to  a  fitting  on  the  unloading  line  of  a  railroad 
tank  car  fractured  and  separated,  causing  the  release  of  methyl  mercaptan,  a  poisonous  and  flammable  gas. 
About  4:09  a.m.,  shortly  after  the  Riverview  Fire  Department  chief  arrived  on  scene,  the  methyl  mercaptan 
ignited,  engulfing  the  tank  car  in  flames  and  sending  a  fireball  about  200  feet  into  the  air.  Fire  damage  to 
cargo  transfer  hoses  on  an  adjacent  tank  car  resulted  in  the  release  of  chlorine,  a  poisonous  gas  that  is  also 
an  oxidizer.  The  fire  was  extinguished  about  9:30  a.m.  Three  plant  employees  were  killed  in  the  accident. 
There  were  several  other  injuries;  most  of  the  injured  were  treated  for  respiratory  symptoms  and  released. 
About  2,000  residents  were  evacuated  from  their  homes  for  about  10  hours.  Two  tank  cars,  railroad  track, 
and  plant  equipment  (including  hoses  and  fittings)  were  damaged  in  the  fire. 

The  major  safety  issues  identified  in  this  investigation  are  the  adequacy  of  ATOFINAs  procedures  for 
unloading  tank  cars  containing  hazardous  materials  and  the  adequacy  of  Federal  regulations  and  oversight 
for  cargo  transfer  operations  involving  bulk  containers  transporting  hazardous  materials. 

As  a  result  of  its  investigation  of  this  accident,  the  Safely  Board  makes  safely  recommendations  to  the  U.S. 
Department  of  Transportation,  the  Federal  Railroad  Administration,  the  Environmental  Protection  Agency, 
and  the  Occupational  Safety  and  Health  Administration. 


The  National  Transportation  Safety  Board  is  an  independent  Federal  agency  dedicated  to  promoting  aviation,  railroad,  highway,  marine, 
pipeline,  and  hazardous  materials  safety.  Established  in  1967,  the  agency  is  mandated  by  Congress  through  the  Independent  Safety  Board 
Act  of  1974  to  investigate  transportation  accidents,  determine  the  probable  causes  of  the  accidents,  issue  safety  recommendations,  study 
transportation  safety  issues,  and  evaluate  the  safety  effectiveness  of  government  agencies  involved  in  transportation.  The  Safety  Board 
makes  public  its  actions  and  decisions  through  accident  reports,  safety  studies,  special  investigation  reports,  safety  recommendations,  and 
statistical  reviews. 

Recent  publications  are  available  in  their  entirety  on  the  Web  at  <http://www.ntsb.gov>.  Other  information  about  available  publications  also 
may  be  obtained  from  the  Web  site  or  by  contacting: 

National  Transportation  Safety  Board 
Public  Inquiries  Section,  RE-51 
490  LEnfant  Plaza,  S.W. 
Washington,  D.C.  20594 
(800)  877-6799  or  (202)  314-6551 

Safety  Board  publications  may  be  purchased,  by  individual  copy  or  by  subscription,  from  the  National  Technical  Information  Service.  To 
purchase  this  publication,  order  report  number  PB2002-917002  from: 

National  Technical  Information  Service 
5285  Port  Royal  Road 
Springfield,  Virginia  22161 
(800)  553-6847  or  (703)  605-6000 

The  Independent  Safety  Board  Act,  as  codified  at  49  U.S.C.  Section  1154(b),  precludes  the  admission  into  evidence  or  use  of  Board  reports 
related  to  an  incident  or  accident  in  a  civil  action  for  damages  resulting  from  a  matter  mentioned  in  the  report. 
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Executive  Summary 


About  3:45  a.m.,  eastern  daylight  time,  on  July  14,  2001,  at  the  ATOFINA 
Chemicals,  Inc.,  (ATOFINA)  plant  in  Riverview,  Michigan,  a  pipe  attached  to  a  fitting  on 
the  unloading  line  of  a  railroad  tank  car  fractured  and  separated,  causing  the  release  of 
methyl  mercaptan,  a  poisonous  and  flammable  gas.  About  4:09  a.m.,  shortly  after  the 
Riverview  Fire  Department  chief  arrived  on  scene,  the  methyl  mercaptan  ignited, 
engulfing  the  tank  car  in  flames  and  sending  a  fireball  about  200  feet  into  the  air.  Fire 
damage  to  cargo  transfer  hoses  on  an  adjacent  tank  car  resulted  in  the  release  of  chlorine,  a 
poisonous  gas  that  is  also  an  oxidizer.  The  fire  was  extinguished  about  9:30  a.m.  Three 
plant  employees  were  killed  in  the  accident.  There  were  several  other  injuries;  most  of  the 
injured  were  treated  for  respiratory  symptoms  and  released.  About  2,000  residents  were 
evacuated  from  their  homes  for  about  10  hours.  Two  tank  cars,  railroad  track,  and  plant 
equipment  (including  hoses  and  fittings)  were  damaged  in  the  fire. 

The  National  Transportation  Safety  Board  determines  that  the  probable  cause  of 
the  accident  involving  the  release  of  methyl  mercaptan  from  a  tank  car  at  the  ATOFINA 
Chemicals,  Inc.,  plant  in  Riverview,  Michigan,  was  a  fractured  cargo  transfer  pipe  that 
resulted  from  (1)  the  failure  of  ATOFINA  to  adequately  inspect  and  maintain  its  cargo 
transfer  equipment,  and  (2)  inadequate  Federal  oversight  of  unloading  operations 
involving  hazardous  materials.  Contributing  to  the  accident  were  ATOFINA's  reliance  on 
a  tank  car  excess  flow  valve  to  close  in  the  event  of  a  leak  from  cargo  transfer  equipment 
and  the  company's  failure  to  require  appropriate  safety  equipment  for  employees  involved 
in  tank  car  loading  and  unloading  operations. 

As  a  result  of  its  investigation  of  the  accident,  the  National  Transportation  Safety 
Board  identified  the  following  safety  issues: 

•  The  adequacy  of  ATOFINA's  procedures  for  unloading  tank  cars  containing 
hazardous  materials. 

•  The   adequacy   of  Federal   regulations   and   oversight   for   cargo   transfer 
operations  involving  bulk  containers  transporting  hazardous  materials. 

As  a  result  of  its  investigation  of  this  accident,  the  Safety  Board  makes  safety 
recommendations  to  the  U.S.  Department  of  Transportation,  the  Federal  Railroad 
Administration,  the  Environmental  Protection  Agency,  and  the  Occupational  Safely  and 
Health  Administration. 
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Factual  Information 


Accident  Synopsis 

About  3:45  a.m.,  eastern  daylight  time,  on  July  14,  2001,  at  the  ATOFINA 
Chemicals,  Inc.,  (ATOFINA)  plant  in  Riverview,  Michigan,  a  pipe  attached  to  a  fitting  on 
the  unloading  line  of  a  railroad  tank  car  fractured  and  separated,  causing  the  release  of 
methyl  mercaptan,  a  poisonous  and  flammable  gas.  About  4:09  a.m.,  shortly  after  the 
Riverview  Fire  Department  chief  arrived  on  scene,  the  methyl  mercaptan  ignited, 
engulfing  the  tank  car  in  flames  and  sending  a  fireball  about  200  feet  into  the  air.  Fire 
damage  to  cargo  transfer  hoses  on  an  adjacent  tank  car  resulted  in  the  release  of  chlorine,  a 
poisonous  gas  that  is  also  an  oxidizer.  The  fire  was  extinguished  about  9:30  a.m.  Three 
plant  employees  were  killed  in  the  accident.  There  were  several  other  injuries;  most  of  the 
injured  were  treated  for  respiratory  symptoms  and  released.  About  2,000  residents  were 
evacuated  from  their  homes  for  about  10  hours.  Two  tank  cars,  railroad  track,  and  plant 
equipment  (including  hoses  and  fittings)  were  damaged  in  the  fire. 


The  Accident  and  Response 

From  2:00  until  3:00  a.m.  on  July  14,  2001,  employees  at  the  ATOFINA  plant  in 
Riverview,  Michigan,  (see  figure  1)  removed  three  empty1  tank  cars  from  the  Process  462 
loading  area  and  replaced  them  with  three  full  tank  cars.  Two  of  the  loaded  tank  cars  were 
filled  with  chlorine,  a  poisonous  gas,  and  one  was  filled  with  methyl  mercaptan,  a 
poisonous  and  flammable  gas.  In  the  Process  46  area,  the  tank  cars  were  to  be  used  to  feed 
the  chlorine  and  methyl  mercaptan  into  the  production  process  for  the  production  of 
several  other  materials.  (See  figure  2.) 


1  These  cars  likely  still  contained  a  residue  of  product. 

2  The  term  Process  46  refers  to  an  area  of  the  Riverview  facility  that  is  devoted  to  the  production  of 
methane  sulfonyl  chloride  and  methane  sulfonic  acid  through  a  multi-step  synthesis  of  methyl  mercaptan 
with  chlorine.  Greater  detail  concerning  Process  46  operations  is  provided  in  the  "Plant  Information"  section 
of  this  report. 
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Figure  1.  Accident  site. 
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Figure  2.  Accident  site.  (The  circled  area  is  the  area  of  greatest  fire  damage.) 

According  to  one  of  the  employees  who  had  placed  the  loaded  tank  cars,  once  the 
cars  were  positioned,  two  operators  were  assigned  the  task  of  attaching  and  leak-testing 
the  unloading  apparatus  that  connected  the  tank  cars  into  the  plant  piping.  According  to 
the  employee,  the  two  full  chlorine  tank  cars  were  attached  first.  The  attachments  were 
completed  about  3:00  a.m.,  and  the  A  operator3  began  attaching  the  unloading  apparatus  to 
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the  methyl  mercaptan  tank  car.  ATOFINA  operators  told  investigators  that  it  takes  about 
15  minutes  to  attach  and  leak-test  the  tank  car  fittings. 

ATOFINA  employees  first  became  aware  of  a  problem  in  the  Process  46  area  at 
3:45  a.m.  when  someone  activated  a  fire  alarm  for  the  area.4  Shortly  afterwards, 
ATOFINA  employees  heard  the  shift  superintendent5  on  the  two-way  radio  asking  that  911 
be  called.  At  3:47  a.m.,  a  methyl  mercaptan  sensor  in  the  control  room  on  the  second  floor 
of  the  Process  46  operations  center  registered  an  elevated  level  of  methyl  mercaptan.  A 
process  operator  in  the  control  center  said  she  became  aware  of  a  product  release  when  she 
smelled  methyl  mercaptan  and  then  heard  the  alarms  sounding  at  the  plant.  She  looked  out 
of  her  building  and  saw  the  shift  superintendent  lying  on  the  ground  near  a  manually 
operated  area  fire  alarm  about  50  feet  from  the  tank  car  unloading  area.  She  then  began 
securing  her  process  in  accordance  with  company  emergency  response  procedures. 

When  the  Process  46  area  fire  alarm  sounded,  ATOFINA  employees  from  two 
other  plant  process  areas  put  on  self-contained  breathing  apparatus  (SCBA)  and  went  to 
the  area.  Because  methyl  mercaptan  is  a  flammable  gas  that  could  ignite  at  any  time,  this 
initial  rescue  attempt  had  to  be  performed  quickly.  The  employees  found  the  B  operator 
and  the  shift  superintendent  and  removed  them  from  the  Process  46  area.  The  A  operator 
was  not  found  at  that  time.  The  two  injured  employees  were  transported  by  ambulance  to 
Riverside  Osteopathic  Hospital  (about  2.7  miles  from  the  plant),  where  they  were 
pronounced  dead. 

Also  in  response  to  the  fire  alarm,  the  ATOFINA  fire  crew  drove  the  plant  fire 
engine  to  the  Process  46  area.  Once  there,  an  employee  on  the  fire  crew  reported  seeing 
fumes  coming  out  of  the  top  of  the  methyl  mercaptan  tank  car.  The  fire  crew  began 
spraying  water  toward  the  tank  car  to  knock  down  the  fumes. 

At  3:48  a.m.,  the  Riverview  911  dispatcher  received  a  call  from  an  ATOFINA 
employee  reporting  "a  man  down"  at  the  ATOFINA  facility.  By  3:52  a.m.,  the  Riverview 
Fire  Department  was  en  route  to  the  scene.  About  the  same  time,  the  911  dispatcher 
received  a  second  call  from  the  ATOFINA  plant  reporting  a  release  of  methyl  mercaptan. 
By  3:58  a.m.,  the  first  two  units  of  the  Riverview  Fire  Department  were  on  scene.  At 
4:08  a.m.,  the  dispatcher  received  a  third  call  from  the  ATOFINA  plant  reporting  "at  least 
four  people  down,"  the  need  for  several  ambulances,  and  the  need  for  responders  to  wear 
SCBAs. 

At  4:09  a.m.,  the  leaking  methyl  mercaptan  ignited,  completely  engulfing  the  tank 
car  in  flames.  The  Riverview  fire  chief,  who  witnessed  the  ignition,  said  the  ignition 


3  Employees  designated  as  operators  perform  various  tasks  within  a  production  process.  They  are 
identified  as  "A"  and  "B"  operators,  with  the  "A"  designation  being  given  to  the  more  experienced 
employee. 

4  The  fire  alarm  was  likely  being  used  as  a  general  alarm,  since  the  first  evidence  of  a  fire  was  when 
the  escaping  gas  ignited  some  19  minutes  later. 

5  The  shift  superintendent  supervises  the  work  of  the  entire  plant  during  off  shifts  and  is  not  directly 
involved  in  tank  car  loading  and  unloading  operations. 
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resulted  in  a  fireball  that  extended  an  estimated  200  feet  into  the  air.  When  the  fireball 
occurred,  the  Riverview  fire  chief  requested  mutual  aid  from  the  surrounding 
communities.  Riverview  Fire  Department  responders  began  applying  water  to  the  tank 
cars  involved  in  the  fire  and  to  the  adjacent  tank  cars  to  keep  them  cool.  (See  figure  3.) 
Units  from  the  Wyandotte,  Trenton,  and  Brownstown  Fire  Departments,  and  the 
Downriver  Mutual  Aid  HAZMAT  Team6  responded. 


Figure  3.  Overview  of  accident  site  and  emergency  response. 

About  5:00  a.m.,  the  Grosse  He  Police  Department  advised  the  Riverview  fire 
chief  that  strong  odors  were  detected  in  Grosse  He.  At  that  time,  according  to  the 
Riverview  fire  chief,  the  wind  direction  was  out  of  the  northwest  to  the  southeast  at  about 
12  to  15  mph.  Grosse  He  is  southeast  of  the  ATOFTNA  plant.  At  first,  the  Riverview  fire 
chief  advised  the  Grosse  He  Police  Department  to  have  the  residents  shelter-in-place.7 
However,  about  5:19  a.m.,  after  re-evaluating  the  situation,  the  Riverview  fire  chief 
requested  the  evacuation  of  residents  of  parts  of  Riverview,  Trenton,  Grosse  He,  and 
Wyandotte.  In  all,  about  2,000  residents  of  the  surrounding  communities  were  evacuated 
from  their  homes  and  businesses. 


6  The  Downriver  Mutual  Aid  HAZMAT  Team  comprises  30  personnel  from  1 7  local  fire  departments 
specifically  trained  in  handling  hazardous  materials  emergencies. 

7  Shelter-in-place  is  an  emergency  response  action  used  after  the  release  of  potentially  dangerous  gases 
or  vapors  from  a  source  outside  a  building.  It  involves  having  occupants  remain  within  their  building  with 
the  air  circulation  turned  off  until  the  area  is  determined  to  be  safe. 


Factual  Information 5 Hazardous  Materials  Accident  Report 

The  methyl  mercaptan  tank  car  fire  was  allowed  to  burn  itself  out  while  the  water 
streams  continued  to  cool  the  tank  cars.  Records  of  the  exact  time  the  fire  went  out  vary; 
however,  there  was  general  agreement  that  it  occurred  after  8:30  a.m.  The  Riverview  Fire 
Department's  report  stated  that  "at  12:47  p.m.  the  methyl  mercaptan  leak  and  fire  had 
stopped,"  but  the  Riverview  fire  chief  later  stated  that  the  fire  was  out  between  8:30  and 
9:30  a.m.  After  the  fire  was  out,  a  reconnaissance  team  equipped  with  SCBAs  and 
protective  suits  entered  and  examined  the  site.  The  team  found  the  partially  burned  body 
of  the  A  operator  on  the  tracks  near  the  south  end  of  the  methyl  mercaptan  tank  car. 

Several  entry  teams  were  sent  into  the  accident  area  after  the  reconnaissance  team 
to  search  the  site  and  close  any  open  valves.  One  entry  team  found  that  the 
1 -inch-diameter  transfer  pipe  in  the  unloading  apparatus  attached  to  the  unloading  valve 
for  the  methyl  mercaptan  tank  car,  UTLX  900558,  had  failed  and  separated.  The  failure 
occurred  in  the  threaded  section  of  the  pipe  where  it  entered  a  2-inch  to  1-inch  reducer 
mounted  on  the  tank  car's  unloading  valve.  The  unloading  valve  was  open,  and  the  tank 
car's  full  load  of  147,350  pounds  of  methyl  mercaptan  had  been  released.  Both  valves  on 
the  flexible  hose  that  connected  the  unloading  apparatus  to  the  plant  process  were  closed, 
and  the  hose  itself  was  burned  through.  The  team  closed  the  tank  car's  unloading  valve. 

The  flexible  hose  that  connected  the  unloading  apparatus  on  the  adjacent  chlorine 
car  (DCTX  27444)  to  the  plant  process  was  found  burned  through.  The  tank  car  unloading 
valve  and  all  in-line  valves  between  the  tank  car  and  the  plant  piping  were  open  when  the 
entry  teams  arrived.  These  valves  were  then  closed.  Because  of  the  relatively  short  time 
that  elapsed  between  the  damage  to  the  flexible  hose  and  the  closing  of  the  valves,  only 
about  26,500  of  the  178,560  pounds  of  chlorine  in  the  tank  car  were  released.  At 
2:48  p.m.,  all  the  plant  and  tank  car  valves  were  confirmed  closed,  and  at  3:07  p.m.,  the 
evacuation  was  lifted. 

About  1:30  p.m.  on  July  15,  2001,  all  Riverview  Fire  Department  active  units  were 
released,  with  the  exception  of  one  engine  and  two  firefighters.  Riverview  Fire 
Department  personnel  remained  on  scene  until  July  17,  2001,  monitoring  the  accident  site 
for  residue  of  hazardous  materials  to  ensure  that  it  was  safe  to  allow  investigators  to  enter 
the  area. 


Injuries 

According  to  the  Wayne  County  Deputy  Medical  Examiner,  the  B  operator  and  the 
shift  superintendent  sustained  fatal  injuries  consisting  of  methyl  mercaptan  intoxication. 
The  A  operator  had  fatal  injuries  consisting  of  thermal  burns  and  methyl  mercaptan 
intoxication. 

One  ATOFINA  employee  was  injured  when,  after  inhaling  methyl  mercaptan 
fumes,  he  fell  to  the  ground  and  fractured  three  ribs.  Five  other  employees  sustained  minor 
injuries,  including  muscle  strains,  abrasions,  and/or  inhalation  injuries.  Three  emergency 
responders  sustained  minor  inhalation  injuries,  including  nasal  irritation.  At  least  40 
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residents  of  the  communities  surrounding  the  ATOFINA  plant  complained  of  sore  throats, 
headaches,  and/or  dizziness;  they  were  treated  and  released  from  local  hospitals.  (See 
injury  table.) 

Table  1.  Injuries. 


Injury  Scale3 

ATOFINA 
Employees 

Emergency 

Responders 

Others 

Total 

Fatal 

3 

0 

0 

3 

Serious 

1 

0 

0 

1 

Minor 

5 

3 

40 

48 

Total 

9 

3 

40 

52 

a49  Code  of  Federal  Regulations  830.2  defines  fatal  injury  as  "any  injury  which  results  in  death  within  30  days  of  the 
accident"  and  serious  injury  as  "an  injury  which:  (1 )  requires  hospitalization  for  more  than  48  hours,  commencing 
within  7  days  from  the  date  the  injury  was  received;  (2)  results  in  a  fracture  of  any  bone  (except  simple  fractures  of 
fingers,  toes,  or  nose);  (3)  causes  severe  hemorrhages,  nerve,  or  tendon  damage;  (4)  involves  any  internal  organ;  or 
(5)  involves  second  or  third-degree  burns,  or  any  burn  affecting  more  than  5  percent  of  the  body  surface." 

At  5:04  a.m.  on  the  day  of  the  accident,  some  5  to  10  minutes  after  the  arrival  of 
the  shift  supervisor  and  the  B  operator,  employees  at  the  Riverside  Osteopathic  Hospital 
began  to  report  feeling  sick.  Later  that  day,  the  Western  Wayne  County  hazardous 
materials  response  team  determined  that  the  emergency  department  and  external  area  had 
been  contaminated  with  methyl  mercaptan,  and  they  were  closed  until  they  could  be 
decontaminated.  The  decontamination  was  completed  at  1 1 :45  p.m. 


Tank  Car  Information 


The  methyl  mercaptan  car  involved  in  the  fire  was  UTLX  900558,  a  DOT 
105J300W  specification  tank  car  manufactured  by  Union  Tank  Car  Company  in  October 
1988.  The  car  was  a  carbon  steel  pressure  car,  with  thermal  protection  and  insulation 
covered  by  a  steel  jacket.  The  tank  car's  water  capacity  was  24,983  gallons. 

The  adjacent  chlorine  tank  car  also  involved  in  the  fire  was  DCTX  27444,  a  DOT 
105A500W  specification  tank  car  manufactured  by  North  American  Tank  Car  in  1973. 
This  car  was  a  carbon  steel  pressure  car,  with  thermal  protection  and  insulation  covered  by 
a  steel  jacket.  The  tank  car's  water  capacity  was  17,300  gallons. 

Both  tank  cars  had  liquid  and  vapor  valves,  and  they  each  had  a  pressure  relief 
device  mounted  within  a  protective  dome  on  the  top  of  the  tank.  The  liquid  valve  opening 
on  the  methyl  mercaptan  tank  car  had  a  2-inch  inside  diameter;  the  liquid  valve  opening 
on  the  chlorine  tank  car  had  a  1-inch  inside  diameter.  The  liquid  valves  were  used  for 
unloading  the  methyl  mercaptan  and  chlorine  from  the  tank  cars. 
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Excess  flow  valves  for  each  unloading  (liquid)  valve  were  installed  in  the  eduction 
pipe8  inside  each  tank  car.  According  to  Federal  regulations,  an  excess  flow  valve  is 
designed  as  a  device  that  "closes  automatically  against  the  outward  flow  of  the  contents  of 
the  tank  in  case  the  external  tank  car  closure  valve  is  broken  off  or  removed  during 
transit."9  According  to  the  Chlorine  Institute's  Chlorine  Manual,  an  excess  flow  valve 
"may  close  if  a  catastrophic  leak  involving  a  broken  connection  occurs  but  it  is  not 
designed  to  act  as  an  emergency  shut-off  device  during  transfer."10  The  excess  flow  valve 
will  not  activate  if,  as  in  this  accident,  the  flow  rate  does  not  exceed  the  normal  transfer 
rate  by  a  sufficient  margin. 


Unloading  Apparatus  Information 

The  first  component  of  ATOFINAs  unloading  apparatus  consisted  of  a 
1 -foot-long,  1 -inch-diameter  steel  pipe  with  a  2-  to  1-inch  reducer  threaded  onto  one  end 
and  a  four-bolt  flange  threaded  onto  the  other.  In  preparation  for  product  transfer,  the 
reducer  end  of  the  pipe  was  passed  through  an  access  hole  on  the  side  of  a  tank  car  dome, 
and  the  reducer  was  threaded  onto  the  tank  car's  unloading  valve.  The  1-inch  pipe  was  the 
one  that,  in  this  accident,  failed  and  separated,  releasing  the  methyl  mercaptan. 

Additional  cargo  unloading  components  were  then  attached  to  the  4-bolt  flange. 
These  components  included  a  pressure  gauge,  a  90-degree  elbow,  a  gate  valve,  two 
T-fittings,  several  lengths  of  1-inch  pipe,  and  a  flexible  hose  that  attached  to  the  plant 
process  piping.  (See  figure  4.)  The  total  weight  of  the  unloading  apparatus  was  about 
53  pounds.  With  the  exception  of  the  downstream  end  of  the  flexible  hose,  which  was 
attached  to  the  plant  piping,  the  unloading  apparatus  was  supported  only  by  the  reducer  and 
the  1-inch  pipe  mounted  in  the  tank  car  unloading  valve. 


8  An  eduction  pipe  is  a  long  steel  pipe  attached  to  the  liquid  valve  that  extends  to  the  bottom  of  the 
tank.  The  pipe  is  used  to  unload  liquid  material  from  the  tank  car. 

9  Title  49  CFR  179.100-13(d). 

10  The  Chlorine  Institute,  Chlorine  Manual,  Sixth  Edition,  Washington,  DC.  January  1997.  Section 

3.2.3.3,  page  14. 
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*       Tank  Car 
Dome  Area 

2"-1"  Reducer 
(threaded  into 
the  unloading 
[liquid]  valve) 


Unloading  \ 
Valve     / 


Not  to  Scale 


A-end  of  Tank  Car 


Tank  Car' 
(Top  View) 


Dome 
(Normally  open  during  unloading) 


Figure  4.  Overhead  view  of  unloading  apparatus.  (For  clarity,  the  pressure  gauge, 
valves,  and  scrubber  line  have  been  rotated  into  the  horizontal  plane.) 


Damage 

Visible  damage  to  methyl  mercaptan  tank  car  UTLX  900558  consisted  of  fire 
damage  to  the  jacket,  wheels,  axles,  bearings,  brake  components,  and  safety  appliances. 
The  fire  affected  approximately  90  percent  of  the  car.  The  visible  damage  to  chlorine  tank 
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car  DCTX  27444  consisted  of  fire  damage  to  the  jacket  and  running  components  on  the 
left  side  (facing  the  B-end)  of  the  car.  This  side  was  facing  tank  car  UTLX  900558. 

As  noted  earlier,  a  1 -inch-diameter  steel  pipe  in  the  unloading  apparatus  of 
UTLX  900558  was  separated  at  the  point  the  pipe  threads  exited  a  2-  to  1-inch  reducer 
installed  in  the  tank  car's  unloading  valve.  The  flexible  hoses  attached  to  the  unloading 
apparatus  on  both  tank  cars  were  melted  and  partially  consumed  by  the  fire. 

Damage  to  the  plant  was  limited  to  fire  exposure  on  the  methyl  mercaptan 
unloading  station,  which  resulted  in  melting  or  damaging  most  of  the  non-ferric  fittings, 
gauges,  and  other  apparatus;  fire  exposure  and  warping  of  the  track  under  the  methyl 
mercaptan  tank  car;  and  scorching  of  track  ties  and  nearby  wooden  planking. 


Metallurgical  Examination 

The  Safety  Board's  metallurgical  examination  of  the  separated  steel  pipe  in  the 
unloading  apparatus  (figure  5)  did  not  identify  any  evidence  of  preexisting  cracks  on  the 
fracture  surface;  the  fracture  features  were  typical  of  an  overstress  separation. 
Examination  of  the  pipe  revealed  evidence  of  corrosion,  including  deposits  of  iron  oxide 
(rust)  and  pitting  on  both  interior  and  exterior  surfaces.  (The  interior  surfaces  of  the  pipe 
were  exposed  to  the  weather  whenever  the  unloading  apparatus  was  not  in  place  on  a  tank 
car.) 


Transfer  Pipe 


Reducer 


i'lf'i 


Figure  5.  Separated  transfer  pipe. 
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Measurements  of  the  interior  and  exterior  diameters  at  several  locations  on  the 
length  of  the  pipe  were  compared  with  interior  and  exterior  diameters  for  new  pipe.  These 
comparisons  revealed  that  the  outside  diameter  was  comparatively  the  same  as  that  of  new 
pipe;  however,  the  inside  diameter  near  the  end  of  the  pipe  where  the  failure  occurred 
showed  evidence  of  erosion-corrosion  damage  (discussed  in  the  next  section)  that  reduced 
the  wall  thickness  near  the  fracture  by  about  23  percent  as  compared  to  the  inside  diameter 
of  new  pipe. 

Calculations  made  using  the  weight  of  each  of  the  unloading  apparatus 
components,  their  distances  from  the  pipe  separation,  the  standard  (as  manufactured)  wall 
thickness  of  1-inch  pipe,  and  standard  piping  design  and  engineering  formulas  indicate 
that  bending  stresses  on  a  new  pipe  at  the  point  the  pipe  entered  the  reducer  would  have 
been  20,800  pounds  per  square  inch  (psi).  The  wall  thickness  reduction  of  the  accident 
pipe  that  resulted  from  erosion-corrosion  resulted  in  a  20-percent  increase  in  the 
calculated  bending  stress  on  the  pipe,  to  25,100  psi  at  the  point  of  fracture.  Comparing  the 
bending  stress  to  the  strength  of  the  material,  Safety  Board  metallurgists  estimated  that  an 
additional  force  of  about  175  pounds  (added  to  the  existing  force  represented  by  the 
weight  of  the  unloading  apparatus),  if  applied  at  the  outer  end  of  the  unloading  apparatus, 
would  cause  an  overstress  failure  (fracture)  of  the  pipe. 


Erosion-Corrosion 

ASM  International,  a  society  for  materials  engineers  and  scientists,  in  its  Metals 
Handbook,11  defines  "erosion"  as  the  "destruction  of  metals  or  other  materials  by  the 
abrasive  action  of  moving  fluids...."  "Erosion-corrosion"  is  defined  as  "a  conjoint  action 
involving  corrosion  and  erosion  in  the  presence  of  a  moving  corrosive  fluid,  leading  to  the 
accelerated  loss  of  material."  It  should  be  noted  that,  while  methyl  mercaptan  is  not 
considered  to  have  a  significant  corrosive  effect  on  steel,  exposure  of  steel  to  the 
atmosphere  does  produce  corrosion.  And  while  corrosive  products  (rust  on  steel)  tend  to 
form  a  protective  layer  that  retards  further  corrosion,  ASM  International  notes  in  its 
Metals  Handbook  that: 

Turbulence  [in  the  fluid]  has  the  ability  to  physically  disrupt  and  tear  away  the 
various  types  of  protective  films... exposing  the  bare  metal  for  subsequent 
corrosion....  Turbulent  conditions  are  created  by  changes  in  diameter  in  piping 
systems.  Bends  and  elbows  likewise  create  conditions  conducive  to  changes  in 
velocity  that  create  turbulent  conditions,  sometimes  called  cavitation,  wherein 
bubbles  of  air  contained  in  the  fluid  can  collapse  and  exert  an  abrasive  action 
against  any  protective  films  formed  on  the  pipe  surface. 


ASM  International,  Metals  Handbook,  Ninth  Edition,  Volume  13  (Materials  Park,  Ohio:  1987). 
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Hazardous  Materials 

Methyl  Mercaptan 

Methyl  mercaptan  is  a  U.S.  Department  of  Transportation  (DOT)  hazard 
Division  2.3  (poison  gas)  material  that  is  also  flammable.  According  to  U.S.  Coast  Guard 
chemical  and  hazardous  response  information  system  (CHRIS)  data,12  the  IDLH  value13 
for  methyl  mercaptan  is  150  parts  per  million  in  air  (ppm).  The  flash  point  is  0°  F.  Methyl 
mercaptan  is  a  colorless  gas  that  has  a  garlic  or  rotten  cabbage  odor.  Inhalation  and  skin 
contact  are  the  primary  routes  of  exposure.  Methyl  mercaptan  is  irritating  to  the  skin,  eyes, 
mucous  membranes,  and  respiratory  tract.  Persons  coming  in  contact  with  methyl 
mercaptan  may  experience  nausea,  vomiting,  headache,  or  dizziness,  especially  when 
exposure  occurs  without  adequate  ventilation.  High  concentrations  may  produce  central 
nervous  system  effects  such  as  staggering  gait,  muscular  weakness,  convulsions,  paralysis 
of  the  respiratory  center,  and  death.  The  ATOFINA  material  safety  data  sheets  state  that 
where  airborne  exposure  to  methyl  mercaptan  is  likely,  approved  respiratory  protection 
equipment  is  appropriate.  Contact  with  combustible  materials  may  enhance  the  risk  of 
fire,  and  exposure  to  solid  bleach  or  strong  oxidizers  may  cause  a  violent  reaction  and  fire. 

Chlorine 

Chlorine  is  a  DOT  hazard  Division  2.3  (poison  gas)  material  that  is  also  corrosive. 
Chlorine  is  a  greenish-yellow  gas  with  a  distinctive  odor.  According  to  U.S.  Coast  Guard 
CHRIS  data,  the  IDLH  value  for  chlorine  is  10  ppm.  Exposure  to  chlorine  gas  can  cause 
severe  irritation  of  eyes  and  respiratory  tract  with  shortness  of  breath,  choking  sensation, 
dizziness,  lung  edema,  and  blindness.  Inhalation  is  the  primary  route  of  exposure.  The 
material  may  be  fatal  if  inhaled.  The  ATOFINA  material  safety  data  sheets  state: 

When  airborne  exposure  limits  are  exceeded,  use  NIOSH  [National  Institute  for 
Occupational  Safety  and  Health]  approved  respiratory  protection  equipment 
appropriate  to  the  material  and/or  its  components  (full  facepiece  recommended). 


Personnel  Information 

The  A  operator  for  Process  46  was  hired  by  Pennwalt  Corporation  (which  later 
became  ATOFINA)  on  January  5, 1983,  as  a  utility  person.  In  1986,  he  began  working  as  a 
process  operator  in  the  production  department.  At  ATOFINA,  he  completed  safety  training 
in  such  areas  as  firefighting,  SCBA,  respirator,  hazardous  waste  operations  and  emergency 
response  (HAZWOPER),  and  hazard  communication. 


12  United  States  Coast  Guard,  United  States  Coast  Guard  Chemical  and  Hazardous  Response 
Information  System,  COMDTINST  16465. 12C,  Version  1.0,  January  2000. 

13  The  IDLH  (immediately  dangerous  to  life  and  health)  value  is  an  atmospheric  concentration  of  any 
toxic,  corrosive,  or  asphyxiate  substance  that  poses  an  immediate  threat  to  life  or  would  cause  irreversible  or 
delayed  adverse  health  effects,  or  would  interfere  with  an  individual's  ability  to  escape  from  a  dangerous 
atmosphere.  The  Environmental  Protection  Agency  uses  10  percent  of  the  IDLH  value  when  determining 
that  a  release  has  reached  a  level  of  concern  for  public  exposure. 
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The  B  operator  for  Process  46  was  hired  on  July  31,1 987,  and  began  working  as  a 
process  operator  in  the  production  department.  He  had  completed  the  same  safety  training 
as  the  A  operator. 

The  two  operators  had  worked  for  about  a  week  on  this  same  shift.  ATOFINA 
co-workers  who  saw  the  operators  the  night  of  the  accident  told  Safety  Board  investigators 
that  the  operators  appeared  to  be  in  good  condition,  and  they  noticed  nothing  unusual 
about  the  operators'  performance. 


Toxicological 

Postaccident  drug  and  alcohol  tests  were  conducted  on  the  bodies  of  the 
A  operator,  the  B  operator,  and  the  shift  superintendent  who  died  as  a  result  of  injuries 
sustained  during  the  accident.  All  test  results  were  negative. 


Plant  Information 

ATOFINA  Chemicals,  Inc.,  formerly  Elf  Atochem  North  America,  Inc.,  is 
headquartered  in  Philadelphia,  Pennsylvania.  ATOFINA  produces  and  markets  chemical 
intermediates  and  performance  polymers.  Chemicals  have  been  produced  at  the 
Pviverview,  Michigan,  plant  under  a  variety  of  owners  since  1898.  Elf  Atochem  North 
America,  Inc.,  took  over  ownership  after  a  company  merger  in  1990.  Today,  the  plant 
manufactures  47  products  and  produces  approximately  70  million  pounds  of  organic 
chemicals  annually.  Approximately  190  persons  are  employed  at  the  plant.  Most  raw 
hazardous  materials  used  at  the  facility  arrive  by  rail.  Finished  hazardous  products  are 
shipped  from  the  plant  by  rail  and  truck.  The  plant  has  5  processes  that  load  or  unload  tank 
cars  and  10  processes  that  load  or  unload  highway  cargo  tanks. 

Process  46 

The  area  of  the  Riverview  facility  designated  as  "Process  46"  produces  methane 
sulfonyl  chloride  by  a  multi-step  synthesis  of  methyl  mercaptan  with  chlorine.  Methane 
sulfonyl  chloride  is  an  intermediate  material  used  in  the  photographic,  agricultural,  and 
pharmaceutical  industries.  Process  46  also  produces  methane  sulfonic  acid.  Methane 
sulfonic  acid  is  used  as  an  intermediate  chemical  in  the  agricultural,  electronics,  and 
pharmaceutical  industries.  The  methyl  mercaptan  and  chlorine  are  offloaded  from  tank 
cars  and  fed  to  the  plant  process  as  needed. 

At  any  given  time,  five  tank  cars  are  situated  on  tracks  inside  the  Process  46  area. 
Two  of  the  five  tank  cars  contain  methyl  mercaptan.  They  are  attached  to  the  plant  piping 
and  are  used,  one  car  at  a  time,  to  supply  the  material  to  the  process.  When  one  car  is 
empty,  it  is  removed  and  replaced  with  a  full  one  while  the  other  car  supplies  material. 
Two  chlorine  tank  cars  are  used  in  a  similar  manner,  except  that  they  are  not  attached 
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directly  to  the  process  plant  piping.  Instead,  their  piping  is  connected  to  a  chlorine 
"anchor"  tank  car  that  is  positioned  permanently  on  a  track  scale.  Chlorine  is  then  fed  to 
the  process  through  piping  from  the  anchor  tank  car. 

According  to  the  Riverview  plant  production  supervisor,  pipes  and  fittings  for  the 
methyl  mercaptan  and  chlorine  transfer  equipment  are  not  inspected  or  replaced  on  a 
routine  or  scheduled  basis.  According  to  ATOFINA  management,  a  search  through  about 
5  years  of  records  did  not  reveal  any  inspection  or  replacement  records  for  the  failed 
1  -inch-diameter  steel  pipe  that  was  inserted  in  the  reducer  on  methyl  mercaptan  tank  car 
UTLX  900558. 

Methyl  Mercaptan  Unloading  Procedures14 

A  Process  46  operator  not  on  duty  at  the  time  of  the  accident  described  how  two 
operators  for  this  process  connect  the  tank  car  to  the  plant  piping.  As  soon  as  a  new  tank 
car  is  moved  into  position,  one  operator  climbs  to  the  top  of  the  tank  car  using  the  stairs  on 
the  working  platform  while  the  other  connects  a  ground  wire  to  the  car  to  protect  against 
static  electricity.  No  SCBAs  or  escape  hoods  are  worn  or  carried  by  either  operator.  The 
operator  on  the  top  of  the  car  then  opens  the  cover  assembly  for  the  tank  car's  protective 
dome.  If  methyl  mercaptan  is  leaking  from  the  tank  car,  the  operator  on  the  car  can  detect 
its  odor  as  soon  as  the  dome  lid  is  opened.  If  a  leak  is  detected,  the  operator  closes  the  lid 
and  notifies  the  plant's  emergency  response  team.  If  no  leak  is  detected,  the  operators 
visually  check  all  valves  to  verify  that  they  are  closed.  Next,  one  of  the  operators  removes 
the  plug  in  the  tank  car's  vapor  valve  opening15  and  threads  a  nitrogen  line  into  the  vapor 
valve.  The  nitrogen  line  provides  additional  pressure  to  the  tank  car,  as  needed,  to  assist  in 
unloading  the  methyl  mercaptan.  An  operator  then  removes  the  plug  for  one  of  the  two 
unloading  valves  and  passes  the  first  component  of  the  unloading  apparatus  (which 
includes  the  1  -inch-diameter  pipe  that  failed  in  this  accident)  through  an  access  hole  in  the 
side  of  the  protective  dome  and  threads  the  reducer  into  the  unloading  valve  opening.  The 
operators  then  connect  the  other  components  of  the  cargo  unloading  apparatus  to  the  first 
component  using  the  four-bolt  flange  on  the  other  end  of  the  1 -inch-diameter  pipe.  These 
components  are  attached  to  a  flexible  hose  that  leads  to  the  plant  piping. 

According  to  the  operator  who  provided  the  description  of  the  connection  process, 
once  the  attachment  has  been  completed,  the  operators  check  the  connections  for  leaks. 
First,  they  test  the  vapor  connection  to  the  tank  car  by  turning  on  the  nitrogen  feed  from 
the  plant  with  the  tank  car's  vapor  valve  closed;  any  leaks  of  nitrogen  are  audible.  If  they 
detect  no  leaks,  the  nitrogen  feed  is  left  on  and  the  vapor  valve  is  kept  closed.  Next,  they 
test  the  unloading  connection  to  the  tank  car.  With  the  downstream  valve  on  the  unloading 
apparatus  closed,  the  operators  slowly  open  the  tank  car's  unloading  valve,  allowing  20  or 
30  psi  of  methyl  mercaptan  to  enter  the  unloading  apparatus  and  register  on  its  pressure 
gauge.  Once  the  desired  20  to  30  psi  of  pressure  is  reached  in  the  unloading  apparatus, 


14  Variations  in  tank  car  design  may  require  slight  modification  of  these  procedures.  The  operator 
described  the  procedures  that  would  have  been  used  for  the  tank  car  involved  in  the  accident. 

15  A  plug  is  threaded  into  the  valve  opening  to  prevent  the  release  of  material  from  the  tank  car  in  case 
the  valve  opens  or  fails  during  transportation. 
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they  close  the  unloading  valve.  The  operators  can  detect  by  odor  any  leak  of  the  poisonous 
methyl  mercaptan  gas  from  the  fittings  on  the  tank  car. 

Once  the  operators  have  made  all  connections  and  verified  that  there  are  no  leaks, 
they  close  the  tank  car  valves,  and  the  tank  car  sits  idle,  grounded  and  ready  for  use. 
According  to  the  operator  who  provided  this  information,  all  connections  are  rechecked 
just  before  the  actual  transfer  process  begins. 

ATOFINA  has  written  step-by-step  instructions  for  these  procedures  in  its  Standard 
Practice  Instructions  Manual.  The  manual  describes  the  sequence  of  actions  necessary  to 
connect  the  transfer  piping  to  a  methyl  mercaptan  tank  car  and  to  test  the  piping  for  leaks 
before  the  tank  car  is  unloaded.  The  instructions  do  not  require  operators  to  wear  SCBAs 
while  working  on  methyl  mercaptan  tank  cars.  Further,  they  do  not  address  carrying  an 
escape  hood  with  an  emergency  (5-  to  10-minute)  air  supply  when  in  the  area  of 
Process  46  tank  cars,  nor  were  such  hoods  carried  by  plant  personnel.  (In  the  event  of 
release  of  poisonous  gas  such  as  occurred  in  this  accident,  emergency  hoods  can  be 
donned  and  should  provide  sufficient  oxygen  to  permit  individuals  to  escape  the  area.) 

ATOFINA's  operators  are  provided  with  copies  of  the  Standard  Practice 
Instructions  Manual  as  part  of  their  training.  Operators  also  go  through  on-the-job  training 
with  an  experienced  operator  to  reinforce  these  procedures. 

Chlorine  Unloading  Procedures 

The  procedures  used  at  ATOFINA  for  unloading  chlorine  from  tank  cars  are 
similar  to  those  used  for  unloading  methyl  mercaptan,  with  the  following  exceptions: 

•  Operators  unloading  chlorine  are  required  to  wear  SCBAs  when  opening  the 
tank  car  dome  cover  and  making  the  connections. 

•  A  spray  bottle  of  ammonia  solution  is  used  to  detect  chlorine  leaks  from  the 
fittings.  (Ammonia  reacts  with  chlorine  to  form  a  visible  white  powder.) 

•  Chlorine  tank  cars  have  two  vapor  valves;  connection  may  be  made  to  either 
valve. 

•  A  high-pressure  dry  air  (instead  of  nitrogen)  line  is  attached  to  one  of  the  two 
vapor  valves  to  provide  additional  pressure,  as  needed. 

•  Connections  are  made  between  chlorine  tank  cars  and  the  anchor  tank  car 
rather  than  directly  to  the  process. 

Emergency  Systems 

Six  methyl  mercaptan  sensors  were  installed  at  various  fixed  locations  throughout 
the  Process  46  area.  The  sensors  monitored  the  concentration  of  methyl  mercaptan  in  the 
air  and  recorded  the  data.  The  methyl  mercaptan  sensors  were  set  to  detect  the  material 
and  record  concentrations  ranging  from  0  to  30  ppm. 
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One  of  the  six  methyl  mercaptan  sensors  was  on  the  tank  car  transfer  platform 
where  the  methyl  mercaptan  tank  car  (UTLX  900558)  was  positioned.  A  review  of  the 
readout  for  that  sensor  revealed  that  it  displayed  either  "0"  or  a  signal  indicating  a 
malfunction  for  the  24-hour  period  reviewed  (from  about  3:15  p.m.  on  July  13  to 
3:15  p.m.  on  July  14).  The  only  sensor  of  the  six  in  the  Process  46  area  that  provided  data 
for  that  24-hour  period  was  the  one  in  the  second-floor  Process  46  control  room.  That 
sensor  read  "0.12"  (ppm)  from  3:13  p.m.  on  July  13  until  3:47  a.m.  on  July  14,  at  which 
time  the  readout  changed  to  "29.88  HIHI"  (indicating  that  the  reading  had  exceeded  a 
preset  maximum).  This  reading  remained  until  5:12  a.m.,  at  which  time  it  began  to 
gradually  decline  to  a  level  of  "0.94"  at  3:13  p.m.  on  July  14. 

Explosion-proof  emergency  switches  to  shut  down  production  pumps  within  the 
process  were  mounted  on  the  Process  46  transfer  platforms  for  the  methyl  mercaptan  and 
chlorine  tank  cars,  the  Process  45/46  control  room,  and  the  northeast  exit  door  of  the 
Process  46  building.  These  switches  did  not  and  were  not  designed  to  close  the  valves  on 
the  methyl  mercaptan  tank  cars.  The  methyl  mercaptan  tank  car  was  not  equipped  with  a 
plant-installed  remote  or  automatic  mechanism  to  stop  the  flow  of  product  during  an 
emergency. 


Federal/State  Oversight 

Federal  Railroad  Administration 

The  Federal  Railroad  Administration  (FRA)  is  responsible  for  ensuring  railroad 
safety  throughout  the  Nation.  FRA  inspectors  are  assigned  to  one  of  five  disciplines,  one 
of  which  is  hazardous  materials.16  FRA  hazardous  materials  inspectors  are  responsible  for 
ensuring  that  offerors17  and  transporters  of  hazardous  materials  by  rail  comply  with 
applicable  provisions  of  the  hazardous  materials  regulations.18  Of  the  approximately  450 
FRA  inspectors  in  the  United  States,  about  50  are  dedicated  to  enforcement  of  the 
hazardous  materials  regulations. 

FRA  hazardous  materials  inspectors  conduct  compliance  reviews  at  offerors' 
facilities  that  ship  hazardous  materials,  as  well  as  at  rail  yards  and  tank  car 
manufacture/repair  facilities.  Because  end  users  of  hazardous  materials,  such  as 
ATOFINA,  become  offerors  when  they  return  tank  cars  containing  a  residue  of  hazardous 
materials  to  the  rail  carriers,  the  FRA  also  inspects  end-user  facilities.  A  single  FRA 
hazardous  materials  inspector  has  oversight  responsibility  for  the  State  of  Michigan.  This 
inspector  stated  that  on  average  he  inspects  each  of  the  approximately  90  offerors' 


16  The  other  four  disciplines  are  track,  operating  practices,  signal  and  train  control,  and  motive  power 
and  equipment. 

17  An  offeror  is  the  entity  (person,  company,  corporation,  association,  etc.)  that  offers  a  hazardous 
material  for  transportation. 

18  The  hazardous  materials  regulations  (49  CFR  Subchapter  C)  are  promulgated  by  the  DOT's  Research 
and  Special  Programs  Administration.  The  FRA  consults  with  the  Research  and  Special  Programs 
Administration  on  rulemakings  specifically  involving  the  transportation  of  hazardous  materials  by  rail. 
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facilities  within  his  region  at  least  once  per  year.  Additionally,  the  inspector  stated  he 
might  return  to  a  facility  and  conduct  additional  inspections  during  the  year  if  an  incident 
occurs  there  or  if  his  office  receives  complaints  about  the  facility. 

The  FRA  regulations  concerning  loading  and  unloading  tank  cars,  found  in 
49  CFR  174.67,  require  that: 

The  tank  car  brakes  are  set. 

Wheels  are  properly  chocked. 

Caution  signs  are  placed  on  the  track. 

Internal  pressure  in  the  tank  car  is  relieved,  as  appropriate. 

•  All  unloading  apparatus,  lines,  and  other  equipment  items  are  securely 
attached  before  tank  car  valves  are  opened. 

•  All  connections  are  disconnected  after  the  tank  car  is  unloaded  or  when 
unloading  is  discontinued  for  any  reason. 

•  The  tank  car  is  attended  during  unloading  operations. 

•  Employees  are  properly  trained  to  perform  hazardous  materials  functions. 

The  FRA  has  issued  hazardous  materials  bulletins  that  explain  FRA  hazardous 
materials  policy  and  provide  guidance  about  various  regulated  activities,  including  tank 
car  unloading,  attendance  requirements  during  the  unloading  of  tank  cars,  and  hazardous 
materials  training.  Such  bulletins  are  advisory  in  nature. 

According  to  the  FRA  hazardous  materials  staff  director,  FRA's  jurisdiction 
concerning  the  hazardous  materials  regulations  encompasses  hazardous  materials  "in 
transportation"  by  rail,  but  the  FRA  has  no  oversight  responsibility  with  respect  to  any 
piece  of  cargo  transfer  equipment  used  to  unload  hazardous  cargo  from  tank  cars  unless 
that  piece  is  a  permanent  part  of  the  car.  Consequently,  FRA  inspectors  do  not  inspect 
hazardous  materials  cargo  transfer  equipment  at  loading  and  unloading  facilities.  Between 
1996  and  June  2001,  FRA  inspectors  performed  seven  inspections  or  audits  at  ATOFINA's 
Riverview  facility.  Of  the  seven  inspections  or  audits,  six  listed  some  type  of  deficiency 
concerning  the  hazardous  materials  regulations.  Among  the  problems  noted  were 
inadequate  training  records,  inadequate  markings,  inadequate  placards,  and  failure  to 
secure  all  closures  on  tank  cars,  which  resulted  in  a  leak  of  hazardous  materials.  Of  these 
violations,  the  FRA  formally  addressed  one — the  failure  to  secure  tank  car  closures — by 
issuing  a  notice  of  probable  violation  and  assessing  a  fine. 

DOT  Regulations  on  Loading  and  Unloading  Hazardous  Materials 

The  definitions  of  "in  transportation"  in  both  49  United  States  Code,  Section  5102, 
and  49  CFR  107.3  specifically  identify  loading  and  unloading  of  hazardous  materials  as 
part  of  transportation  for  all  modes. 

The  DOT  has  developed  regulations  and  oversees  the  area  of  loading  and 
unloading  hazardous  materials.  These  regulations  include: 
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•  49  CFR  173.30  concerns  the  loading  and  unloading  of  transport  vehicles  in  all 
modes  of  transportation. 

•  49  CFR  174.67  concerns  tank  car  unloading. 

•  49  CFR  174.101  -  174.115  concerns  the  loading  of  explosive  materials  being 
transported  by  rail. 

49  CFR  177.834  concerns  the  general  loading  and  unloading  of  highway 
vehicles. 

On  June  14,  2001,  the  DOT's  Research  and  Special  Programs  Administration 
(RSPA)  issued  a  notice  of  proposed  rulemaking  (NPRM),  HM-223,  entitled  Applicability 
of  Hazardous  Materials  Regulations  to  Loading,  Unloading,  and  Storage}9  The  NPRM 
proposed,  for  the  purposes  of  the  hazardous  materials  regulations,  to  define 
"transportation"  for  all  modes  of  transportation,  including  rail,  as  beginning  from  the 
moment  a  carrier  accepts  a  container  or  package  of  hazardous  materials  to  the  moment  the 
carrier  relinquishes  it  to  the  consignee.  In  its  October  29,  2001,  response  to  the  NPRM,  the 
Safety  Board  expressed  its  concern  about  the  proposed  rulemaking  and  stated  that  "the 
proposed  rules  may  result  in  the  elimination  of  effective  Federal  oversight  of  hazardous 
materials  loading/unloading  operations  of  bulk  transportation  containers." 

Environmental  Protection  Agency 

The  Environmental  Protection  Agency's  (EPA's)  mission  is  "to  protect  human 
health  and  to  safeguard  the  natural  environment — air,  water,  and  land — upon  which  life 
depends."  One  part  of  that  mission,  safeguarding  the  air,  is  addressed  in  40  CFR 
Subchapter  C,  Parts  50-99,  which  incorporates  provisions  of  the  Clean  Air  Act  of  1970.20 
EPA's  "General  Guidance  for  Risk  Management  Programs"21  states  that: 

If  you  handle,  manufacturer,  use,  or  store  any  of  the  designated  toxic  or 
flammable  substances  listed  in  40  CFR  68. 130. ..above  the  specified  threshold 
quantities  in  a  process,  you  are  required  to  develop  and  implement  a  risk 
management  program. . . . 

Both  methyl  mercaptan  and  chlorine  are  designated  substances;  methyl 
mercaptan's  threshold  quantity22  is  10,000  pounds,  and  chlorine's  threshold  quantity  is 
2,500  pounds.  The  risk  management  program  requirements  became  effective  in  June 
1996. 


19  Docket  No.  RSPA-98-4952,  66  Federal  Register  32420,  June  14,  2001. 

20  Title  42  United  States  Code,  Sections  7401  et.  seq. 

21  EPA,  General  Guidance  for  Risk  Management  Programs  (40  CFR  Part  68),  EPA  550-B-00-008, 
Washington,  DC.  May  2000. 

22  Threshold  quantity  is  the  minimum  amount  of  toxic  or  flammable  material  in  a  process  above  which 
a  facility  is  required  by  the  EPA  to  develop  a  risk  management  program. 
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The  EPA  general  guidance  document  also  states  that: 

[T]he  goal  of  part  68-the  risk  management  program-is  to  prevent  accidental 
releases  of  substances  that  can  cause  serious  harm  to  the  public  and  the 
environment  from  short-term  exposures  and  to  mitigate  the  severity  of  releases 
that  do  occur. 

Each  risk  management  program  must  contain  a  hazard  assessment  that  includes  an 
offsite  consequence  analysis  and  a  release  prevention  program.  The  EPA  considers  tank 
cars  and  highway  cargo  tanks  that  are  interconnected  with  the  plant's  fixed  equipment  as 
parts  of  the  plant  process  equipment  and  thus  subject  to  EPA  regulations. 

The  offsite  consequence  analysis  is  intended  to  provide  information  about  the 
potential  consequences  of  accidental  releases.  The  analysis  generally  consists  of  a 
worst-case  release  scenario23  involving  one  substance  selected  from  all  the  regulated  toxic 
substances  handled  at  a  facility,  a  worst-case  scenario  for  each  of  the  regulated  flammable 
substances  handled  at  a  facility,  an  alternative  release  scenario  for  each  regulated  toxic 
substance  over  the  threshold  limit,  and  an  alternative  release  scenario  that  represents  all 
flammable  substances  over  the  threshold  limit.  Among  the  items  included  in  a  scenario  are 
the  quantity  of  the  hazardous  material  released  and  the  measures  used  to  prevent  or 
mitigate  the  release. 

The  release  prevention  program  consists  of  12  separate  requirements.24  These 
elements  include  a  requirement  to  develop  and  follow  a  mechanical  integrity  program  for 
piping  systems,  such  as  the  unloading  apparatus,  as  well  as  for  pressure  vessels,  storage 
tanks,  relief  and  vent  systems/devices,  emergency  shutdown  systems,  controls,  and 
pumps.  The  equipment  covered  by  the  mechanical  integrity  element  must  be  inspected  and 
tested  using  good  engineering  practices  and  must,  at  a  minimum,  be  inspected  in 
accordance  with  the  manufacturer's  recommended  inspection  schedule.  Each  mechanical 
integrity  inspection  and  test  must  be  documented. 

In  addition,  each  company  must  describe  the  risk  management  program  in  a  risk 
management  plan  that  must  be  registered  with  the  EPA.  The  risk  management  plan  does 
not  contain  all  the  information  required  in  the  risk  management  program;  however,  it 
provides  the  EPA  with  key  information.  The  worst-case  and  alternative  release  scenarios 
must  be  included  in  this  plan.  Regulated  facilities  had  until  June  1999  to  submit  their  first 
risk  management  plans  to  the  EPA. 

Approximately  15,000  risk  management  plans  have  been  submitted  to  the  EPA. 
The  EPA  uses  a  software  program  entitled  "RMP  Submit"  to  review  the  risk  management 
plans,  but  this  program  only  helps  ensure  that  all  required  fields  within  the  document 
contain  information.  Neither  the  EPA  staff  nor  the  software  program  reviews  the  data  for 
content  or  accuracy.  EPA  regional  staff  indicated  that  some  risk  management  plans  (fewer 


23  The  EPA  defines  worst-case  scenario  as  the  release  of  the  largest  quantity  of  a  regulated  substance 
from  a  single  vessel  or  process  line  that  results  in  the  greatest  distance  to  an  endpoint. 

24  Facilities  regulated  under  the  risk  management  program  are  subject  to  one  of  three  prevention 
program  levels.  Level  3  facilities,  such  as  Riverview,  are  subject  to  the  largest  number  of  requirements. 
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than  a  dozen)  have  been  thoroughly  reviewed  and  that  others  may  be  audited  at  a  later 
date. 

The  EPA  received  the  current  ATOFINA  Riverview  facility  risk  management  plan 
on  July  3,  2000.  At  the  time  the  plan  was  submitted,  14  production  processes  within  the 
facility  were  subject  to  these  regulations,  including  Process  46. 25  The  alternative  toxic 
release  scenarios  for  both  the  methyl  mercaptan  and  chlorine  tank  cars  involve  the  failure 
of  the  flexible  hose  that  connects  the  unloading  apparatus  to  the  plant  piping.  Each 
scenario  lists  the  tank  car's  excess  flow  valve  as  an  active  mitigation  measure. 

The  release  prevention  program  for  Process  46  also  cites  tank  car  "excess  flow 
devices"  as  one  of  the  prevention  methods.  In  addition,  one  of  the  mitigation  systems 
involves  planned  and  periodic  inspections  of  critical  equipment.  The  executive  summary 
for  the  risk  management  plan  specifically  identifies  the  need  for  frequent  inspection  of  the 
unloading  lines.  The  risk  management  plan  also  lists  the  process  gas  monitoring/detection 
systems  as  methods  for  preventing  or  mitigating  a  release. 

On-site  inspection  of  facilities  to  verify  the  compliance  with  the  EPA  regulations 
has  been  left  to  discretion  of  each  EPA  region.  Interviews  with  EPA  Region  V  personnel, 
whose  jurisdiction  includes  the  State  of  Michigan,  revealed  that,  between  the  initiation  of 
the  EPA's  oversight  program  in  June  1996  and  the  July  14,  2001,  accident,  three  on-site 
inspections  covering  the  requirements  of  the  risk  management  program  had  been 
conducted  of  the  approximately  2,800  facilities  that  submitted  risk  management  plans 
within  the  region.  ATOFINA's  Riverview  plant  was  not  one  of  the  three  facilities 
inspected.  After  the  accident,  EPA  regional  personnel  initiated  an  inspection  of  the  portion 
of  ATOFINA's  risk  management  program  concerning  the  Process  46  location  of  the  plant. 

Occupational  Safety  and  Health  Administration 

The  mission  of  the  Occupational  Safety  and  Health  Administration  (OSHA)  is  "to 
prevent  fatalities,  injuries,  and  to  protect  the  health  of  America's  workers."  The 
Occupational  Safety  and  Health  Act  of  1970  (Public  Law  91-596)  was  enacted  "to  assure 
safe  and  healthful  working  conditions  for  working  men  and  women."  The  general  duty 
clause  requires  that  "each  employer  shall  furnish  to  each  of  his  employees  employment 
and  a  place  of  employment  which  are  free  from  recognized  hazards  that  are  causing  or  are 
likely  to  cause  death  or  serious  physical  harm  to  his  employees."  To  achieve  that  goal, 
Congress  delegated  broad,  general  authority  to  the  Secretary  of  Labor  to  regulate  the 
working  conditions  that  affect  the  occupational  safety  and  health  of  the  Nation's 
employees.  OSHA  is  preempted  from  exercising  its  authority  under  this  act  if  another 
Federal  agency  has  been  granted  statutory  authority  to  regulate  the  relevant  working 
conditions  and  if  the  other  Federal  agency  has  exercised  its  authority  in  a  manner  such  as 
to  exempt  the  cited  working  conditions  from  OSHA's  jurisdiction.  As  an  example,  vehicle 
operators  (truckdrivers  or  train  crews)  who  are  regulated  by  the  DOT  are  not  subject  to 
OSHA's  regulations. 


After  July  3,  2000,  1  of  the  14  processes  was  eliminated. 
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The  Occupational  Safety  and  Health  Act  of  1970  also  gives  States  an  opportunity 
to  assume  responsibility  for  occupational  safety  and  health  standards  and  enforcement 
through  the  mechanism  of  an  OSHA-approved  State  plan.  Twenty-one  States,  including 
Michigan,  have  assumed  this  responsibility  for  private  and  public  employees. 

OSHA  regulations  are  codified  in  29  CFR.  Section  1910.119  implements  the 
program  designated  as  the  "process  safety  management  of  highly  hazardous  chemicals." 
Section  1910.119  contains  requirements  for  preventing  or  minimizing  the  consequences  of 
catastrophic  releases  of  toxic,  reactive,  flammable,  or  explosive  chemicals.  The  OSHA 
process  safety  management  program  preceded,  and  was  used  as  a  model  for,  the  EPA's  risk 
management  program.  Like  the  EPA,  OSHA  has  certain  threshold  quantity  limits  for  these 
materials,  but  the  EPA  and  OSHA  limits  are  not  identical.  In  this  case,  OSHA's  threshold 
quantity  limits  are  less  than  the  EPA's:  OSHA  limits  are  5,000  pounds  for  methyl 
mercaptan  and  1 ,500  pounds  for  chlorine. 

OSHA's  Process  Safely  Management  program  emphasizes  the  management  of 
risks  associated  with  highly  hazardous  chemicals.  One  requirement  of  the  Process  Safety 
Management  program  is  the  development  of  a  process  hazard  analysis  for  each  plant 
process  that  involves  quantities  of  a  hazardous  material  in  excess  of  the  OSHA  threshold 
quantity  limit.  Each  process  hazard  analysis  must  identify  potential  hazards  and  propose 
recommendations  to  reduce  the  potential  risks  associated  with  those  hazards.  OSHA 
defines  a  "process"  as  follows: 

[A]ny  activity  involving  a  highly  hazardous  chemical  including  any  use,  storage, 
manufacturing,  handling,  or  the  on-site  movement  of  such  chemicals,  or 
combination  of  these  activities.  For  purposes  of  this  definition,  any  group  of 
vessels  which  are  interconnected  and  separate  vessels  which  are  located  such  that 
a  highly  hazardous  chemical  could  be  involved  in  a  potential  release  shall  be 
considered  a  single  process. 

OSHA  considers  tank  cars  that  transfer  product  to  and  from  a  process  to  be  part  of 
that  process.  The  Process  Safety  Management  program  requirements  apply  to  all 
activities,  including  loading  and  unloading  operations,  that  are  part  of  a  regulated  process. 
Once  completed,  the  process  hazard  analysis  must  be  retained  at  the  employer's  facility. 
Unlike  EPA  requirements,  the  analysis  does  not  have  to  be  submitted  to  either  Federal  or 
State  OSHA. 

OSHA  is  authorized  to  conduct  workplace  inspections  to  determine  whether 
employers  are  complying  with  its  standards  for  safe  and  healthful  workplaces.  OSHA 
safety  and  health  officers  perform  workplace  inspections  to  ensure  compliance.  States 
with  OSHA-approved  programs  use  qualified  State  officers  as  inspectors. 

Because  some  6.2  million  workplaces  are  covered  by  the  Occupational  Safely  and 
Health  Act  of  1970,  which  represents  a  challenge  to  the  agency's  resources,  OSHA  has 
established  a  system  of  inspection  priorities.  First,  imminent  danger  situations  are  given 
top  priority.  OSHA  considers  an  "imminent  danger"  to  be  any  condition  in  which  there  is 
reasonable  certainty  that  a  danger  exists  that  can  be  expected  to  cause  death  or  serious 
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physical  harm  immediately  or  before  the  danger  can  be  eliminated  through  normal 
enforcement  procedures.  Second  priority  is  given  to  investigation  of  fatalities  and 
accidents  resulting  in  the  hospitalization  of  three  or  more  employees.  Third  priority  is 
given  to  employee  complaints  of  alleged  violations  of  standards  or  unsafe/unhealthy 
working  conditions  and  to  referrals  from  other  government  authorities  about  specific 
workplace  hazards.  Lastly,  programmed  inspections  aimed  at  specific  high-hazard 
industries,  workplaces,  occupations,  health  substances,  or  other  industries  are  considered 
and  identified  in  OSHA's  current  inspection  scheduling  procedures.  Follow-up  inspections 
may  be  conducted  to  determine  whether  previously  cited  deficiencies  have  been  corrected. 

In  Michigan,  the  responsibility  for  workplace  safety  falls  to  an  entity  designated 
the  MIOSHA  program  office,  which  is  within  the  Michigan  Department  of  Consumer  and 
Industry  Services,  Bureau  of  Safety  and  Regulation.  The  MIOSHA  program  office  has  76 
compliance  officers  who  enforce  the  workplace  standards  for  4  million  employees 
working  for  200,000  employers  in  Michigan.  MIOSHA  conducted  6,874  inspections  in 
fiscal  year  2000. 

Within  MIOSHA,  the  General  Industry  Safety  Division  is  responsible  for 
overseeing  process  hazard  analysis  at  chemical  plants.  This  division  has  two  officers 
dedicated  to  compliance  at  chemical  plants  and  three  others  who  assist  with  chemical 
plant  oversight  as  a  part  of  their  duties.  In  1993,  while  establishing  a  program  of  chemical 
plant  oversight,  MIOSHA  developed  a  list  of  the  100  facilities  within  Michigan  that  utilize 
the  largest  quantity  and/or  most  dangerous  chemicals  within  their  processes.  From  the  list 
of  100,  each  year  since  1993,  about  10  facilities,  on  average,  have  been  selected  at  random 
for  a  scheduled  program  quality  verification  audit.  This  type  of  audit  was  developed  to 
ensure  comprehensive  and  planned  compliance  inspections  in  large  petrochemical 
manufacturing  plants  with  a  high  potential  for  catastrophic  release.  As  part  of  the  program 
quality  verification  audit,  the  OSHA  process  safety  management  requirements  for  selected 
plant  processes  were  reviewed.  Compliance  was  determined  by  reviewing  written 
programs,  observing  the  process  areas,  and  interviewing  management,  union,  and  hourly 
personnel.  The  MIOSHA  inspector  for  this  program  stated  that,  as  of  May  2002, 
approximately  85  of  the  100  facilities  on  the  1993  list  had  been  inspected. 

According  to  MIOSHA,  the  ATOFINA  facility  in  Riverview  was  the  first  of  the 
100  facilities  inspected  from  the  1993  list.  ATOFINA's  program  quality  verification  audit 
began  on  September  8,  1994.  Audit  team  members  were  on  site  on  a  daily  basis  at  the 
Riverview  facility  through  November  2,  1994,  and  on  an  intermittent  basis  until 
December  20,  1994.  The  audit  team  comprised  four  MIOSHA  inspectors.  According  to 
information  provided  by  MIOSHA,  a  total  of  960  work  hours  were  dedicated  to  the 
inspection.  The  audit  reviewed  all  processes  at  the  Riverview  facility,  but  only  two 
processes  received  in-depth  inspections.  Process  46  was  not  one  of  those  two  processes. 

The  audit  found  that  the  Riverview  facility  had  a  process  safety  management 
program  in  place  but  that  it  contained  significant  deficiencies.  The  initial  citation 
identified  3 1  "serious,"  4  "other  than  serious,"  and  1  "willful"  violations.  Eighteen  of  the 
serious  violations  were  related  to  process  safety  management  standards.  One  of  the  serious 
violations  was  that  reactors,  tanks,  vent  systems,  and  process  piping  systems  were  not 
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being  inspected  or  tested  as  required.   Further,  the  inspection  report  described  the 
Riverview  facility's  overall  mechanical  integrity  program  by  stating: 

The  employer  failed  to  establish  and  implement  a  program  to  inspect  and  test 
process  equipment,  such  as  pressure  vessels  and  storage  tanks  that  contained 
highly  hazardous  chemicals,  using  inspection  and  test  procedures  which  followed 
recognized  and  generally  accepted  good  engineering  practices. 

To  correct  this  deficiency,  MIOSHA  recommended  that  ATOFINA: 

[DJevelop  a  comprehensive  list  of  process  equipment  covered  by  the  mechanical 
integrity  program.  The  list  should  include  the  equipment  identity,  the  inspection  or 
test  reference  (such  as  external  and  internal  visual  examination,  bench  tests, 
non-destructive  tests,  etc.)  and  an  inspection  and  test  schedule.  An  appropriate 
reference  document  should  then  exist  for  each  inspection  and  test  to  be  based  on 
the  consensus  standards  and  codes,  industry  practice,  plant  experience  or  other 
reference  sources.  Inspections  and  tests  must  be  properly  documented  as  required. 

According  to  the  abatement  agreement26  submitted  by  ATOFINA,  the  company 
agreed  to  "develop  written  procedures  to  address  mechanical  integrity  and  inspection  and 
testing  of  equipment  and  piping."  ATOFINA  also  stated  that  it  would  "on  or  before 
November  26,  1997,  document  that  not  less  than  100  percent  of  the  process  equipment 
and  piping  systems  regulated  by  29  CFR  1910.119  (Process  Safety  Management 
Standard)  have  been  inspected  and  tested."  MIOSHA  conducted  no  follow-up  inspection 
to  ensure  that  ATOFINA  had  corrected  the  cited  violations. 

In  fulfilling  the  abatement  agreement,  ATOFINA  developed  a  mechanical  integrity 
program.  The  program  required  periodic  inspections  of  the  wall  thickness  of  plant  piping, 
including  the  transfer  piping  at  all  of  the  tank  car  platforms.  The  inspection  procedures  did 
not  establish  specific  inspection  cycles  but  stated  that  inspections  should  be  conducted 
"often"  where  deterioration  is  "extreme"  and  "seldom"  where  deterioration  is  "minimal." 
The  mechanical  integrity  program  also  contained  procedures  relating  to  the  support  of 
cargo  transfer  equipment,  but  these  procedures  focused  on  detecting  equipment  distortion 
and  broken  anchors  on  plant  piping. 

Following  the  July  14,  2001,  Riverview  accident,  MIOSHA  inspectors  audited 
ATOFINA  and  identified  22  probable  violations  of  OSHA  regulations.  The  enforcement 
action  was  settled  on  May  1,  2002,  without  admission  of  liability.  The  company  paid  a 
penalty  of  $500,000  and  agreed  to  provide  about  $5  million  more  to  make  additional  plant 
improvements  to  enhance  employee  safety,  to  enable  local  emergency  response  agencies 
to  enhance  the  safety  of  the  local  communities,  and  to  perform  audits  of  other  ATOFINA 
facilities  to  improve  employee  safety. 


26  MIOSHA  defines  an  abatement  agreement  as  a  means  of  rapidly  reducing  or  eliminating  (abating)  a 
hazard  whereby  "an  employer  who  appeals  a  citation  within  fifteen  working  days  of  receipt  of  the  citation, 
who  shows  good  faith  to  comply  with  MIOSHA  standards,  and  who  cooperated  with  the  department  during 
the  audit  may  receive  a  monetary  penalty  reduction  of  up  to  fifty  percent,"  provided  the  employer  abates  the 
cited  problems,  provides  proof  of  the  abatement,  pays  the  penalties,  and  abides  by  all  agreed-upon  actions. 
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Emergency  Preparedness 

On  March  1,  2000,  ATOFINA  implemented  an  extensive  general  emergency  plan 
for  the  Riverview  facility  that  included  emergency  procedures  specific  to  Process  46.  The 
purpose  of  the  plan  was  to  minimize  hazards  to  public  health  or  the  environment  caused 
by  fires,  explosions,  or  releases  of  hazardous  waste  or  hazardous  waste  constituents  to  the 
air,  soil,  or  surface  waters.  A  copy  of  the  emergency  plan  was  given  to  the  Riverview  Fire 
Department  and  the  fire  departments  of  the  surrounding  communities,  and  periodic  tours 
and  training  were  provided  to  the  Riverview  and  Wyandotte  Fire  Departments. 

The  emergency  plan  also  stated  that  the  plant  nurse  maintains  an  open  dialogue 
with  the  local  hospitals.  However,  before  July  14,  2001,  interactions  between  ATOFINA 
and  the  Riverside  Osteopathic  Hospital  focused  on  communications  pertaining  to  the 
hospital's  treatment  of  ATOFINA  employees  injured  while  working.  After  the  accident, 
ATOFINA  conducted  a  presentation  for  Riverside  Osteopathic  Hospital  staff  regarding 
chemical  exposure,  basic  toxicology,  decontamination,  and  basic  hazardous  materials 
training  and  recommended  minimum  requirements  for  a  hazardous  materials  room  where 
victims  of  hazardous  materials  accidents  could  be  isolated.  The  hospital  has  developed 
procedures  and  identified  a  room  to  be  used  in  the  event  of  a  future  hazardous  materials 
incident  to  prevent  the  type  of  contamination  that  occurred  in  this  accident. 


Other  Information 

Postaccident  Activities 

Since  the  accident,  ATOFINA  has  made  a  number  of  changes  to  its  plant 
procedures  and  equipment  to  address  problems  identified  during  the  investigation. 
ATOFINA's  mechanical  integrity/preventive  maintenance  program  now  requires  that  the 
cargo  unloading  apparatus,  including  the  integral  piping,  be  removed  from  service  every  2 
years  and  undergo  non-destructive  testing  to  ensure  that  it  is  still  safe  to  be  used. 
ATOFINA  has  redesigned  the  unloading  apparatus  and  has  added  a  remotely  operated 
shutoff  valve.  Operators  are  now  required  to  wear  SCBAs  when  working  on  the  methyl 
mercaptan  tank  cars,  and  they  are  required  to  carry  an  escape  hood  with  an  emergency  air 
supply  when  in  the  area  of  the  tank  cars.  In  addition,  operators  now  perform  leak  tests  on 
the  unloading  apparatus  before  opening  the  valve  to  the  tank  car.  To  perform  the  test, 
operators  attach  the  apparatus  to  the  tank  car,  pressurize  it  with  nitrogen  gas,  and  use  a 
soap  solution  to  visually  detect  leaks.  ATOFINA  has  also  redesigned  the  transfer 
connection  to  the  methyl  mercaptan  tank  cars.  The  redesigned  apparatus  consists  of  a 
2-inch-diameter  pipe  about  1-foot  long  that  is  mounted  vertically  to  the  loading  line  valve 
on  the  tank  car.  A  remotely  actuated  shutoff  valve,  which  is  connected  to  the  downstream 
end  of  the  1-foot  pipe  section,  can  be  closed  from  multiple  locations  during  an  emergency. 
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Industry  Use  of  Excess  Flow  Valves 

Following  the  accident,  Safety  Board  investigators  interviewed  a  sampling  of 
domestic  chemical  companies  that  receive  materials  in  tank  cars  concerning  their  use  of 
excess  flow  valves.  Telephone  interviews  with  personnel  responsible  for  the  company  risk 
management  plans  required  by  the  EPA  and  OSHA  revealed  that  six  of  nine  companies 
surveyed  rely  on  the  tank  car  excess  flow  valves  as  a  method  of  stopping  or  limiting  a  leak 
in  the  transfer  equipment.  Two  of  the  nine  companies  did  not  respond  to  this  question,  and 
the  remaining  company  indicated  that  it  has  remotely  operated  shutoff  valves  on  the 
unloading  piping  just  outside  the  tank  car  dome. 
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Analysis 


This  analysis  is  presented  in  three  main  parts.  In  the  first  part,  the  Safety  Board 
identifies  factors  that  can  readily  be  excluded  as  causal  or  contributory  to  the  accident.  In 
the  second  part,  the  Board  analyzes  the  causes  and  factors  contributing  to  the  severity  of 
the  accident.  In  the  final  part,  the  Board  discusses  the  safety  issues  arising  from  the 
investigation: 

•     The  adequacy  of  ATOFINA's  procedures  for  unloading  tank  cars  containing 
hazardous  materials. 

The   adequacy   of  Federal   regulations   and   oversight   for   cargo   transfer 
operations  involving  bulk  containers  transporting  hazardous  materials. 


Exclusions 

The  following  issues  were  examined  but  were  not  found  to  be  factors  in  this 
accident:  the  tank  car  design,  the  experience  and  condition  of  the  personnel  involved  in  the 
accident,  the  failure  of  the  methyl  mercaptan  sensor  on  the  tank  car  platform,  and  the 
emergency  response.  The  equipment  failures  that  resulted  in  the  accident  occurred  in  the 
unloading  apparatus,  which  were  not  part  of  the  tank  cars,  and  both  tank  cars  withstood 
the  fire  without  catastrophic  failure.  Both  the  operators  who  were  working  on  the  tank  car 
had  14  to  15  years  of  experience  unloading  methyl  mercaptan  from  tank  cars  for  use  in 
Process  46.  Evidence  suggests  that  both  operators  were  behaving  normally  on  the  night  of 
the  accident,  and  postaccident  drug  and  alcohol  test  results  were  negative.  The  Safety 
Board  was  concerned  that  the  methyl  mercaptan  sensor  on  the  platform  near  the  accident 
tank  car  malfunctioned;  however,  ATOFINA  had  multiple  sensors,  and  no  action  that 
could  have  been  taken  in  response  to  an  alarm  from  the  platform  sensor  would  have 
prevented  the  accident  or  reduced  its  severity.  (See  the  discussion  of  the  tank  car's  excess 
flow  valve.)  Since  the  accident,  ATOFINA  has  replaced  the  entire  alarm  system  and  has 
installed  additional  sensors.  The  plant  emergency  response  team  reacted  immediately  to 
the  emergency,  the  local  emergency  response  agencies  arrived  within  10  minutes,  and  both 
sets  of  responders  took  reasonable  measures  to  prevent  the  spread  of  the  fire  and  the 
release  of  other  hazardous  materials.  Additionally,  the  decision  to  evacuate  local  residents 
likely  prevented  their  being  exposed  to  the  poisonous  methyl  mercaptan  gas.  Therefore, 
the  Safety  Board  concludes  that  the  tank  car  design,  the  experience  and  condition  of  the 
personnel  preparing  the  methyl  mercaptan  tank  car  for  unloading,  the  failure  of  the  methyl 
mercaptan  sensor  on  the  tank  car  platform,  and  the  on-scene  emergency  response  were  not 
factors  in  the  accident. 
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The  Accident 

This  accident  occurred  as  a  result  of  a  broken  transfer  pipe  that  allowed  poisonous 
and  flammable  methyl  mercaptan  gas  to  escape  and  contaminate  the  local  area.  While  that 
much  is  known,  because  neither  of  the  two  employees  directly  involved  in  this  accident 
survived,  some  questions  about  the  events  surrounding  the  accident  cannot  be  answered 
with  certainty.  For  example,  it  could  not  be  determined  when  during  the  hookup  operation 
the  fractured  pipe  failed  or  what  exactly  caused  it  to  fail;  that  is,  how  force  was  applied  to 
the  pipe  sufficient  to  cause  it  to  fail.  Nor  could  it  be  determined  why,  after  the  leak  was 
detected,  the  tank  car's  unloading  valve  was  not  shut  off  in  time  to  prevent  all  three 
employees  in  the  area  from  being  overcome  by  the  poison  gas.  The  locations  of  the  three 
employees  and  their  specific  activities  at  the  time  of  the  accident  also  could  not  be 
determined. 

Despite  these  uncertainties,  enough  information  about  the  accident  could  be 
gathered  to  lead  investigators  to  examine  ATOFINA's  plant  procedures  for  the  inspection, 
maintenance,  and  use  of  cargo  transfer  equipment  and  for  the  unloading  of  methyl 
mercaptan  tank  cars.  Investigators  also  examined  ATOFINA's  procedures  and 
requirements  regarding  protective  equipment  as  well  as  Federal  oversight  of  chemical 
transfer  activities. 


Inspection,  Maintenance,  and  Use  of  Cargo  Transfer  Equipment 

Metallurgic  examination  of  the  failed  transfer  pipe  revealed  evidence  of 
erosion-corrosion  resulting  in  a  significant  thinning  of  the  pipe  wall.  The  flow  of  the 
liquefied  methyl  mercaptan  through  the  pipe  caused  a  gradual  erosion  of  the  metal.  The 
erosion  was  accelerated  during  each  exposure  of  the  interior  of  the  pipe  to  the  weather, 
when  atmospheric  corrosion  converted  small  amounts  of  the  steel  to  iron  oxide  (rust). 
Subsequent  liquid  flow  during  unloading  eroded,  or  swept  away,  the  iron  oxide  on  the 
interior  of  the  pipe,  revealing  clean  steel  that  readily  corroded  during  its  next  exposure  to 
the  atmosphere.  The  consequence  of  such  cyclic  action  is  the  gradual  wearing  away  of  the 
interior  surface  of  the  pipe  wall,  which  reduces  the  strength  of  the  pipe. 

During  use,  the  failed  pipe  was  subjected  to  bending  forces  by  the  attachment  of  an 
unloading  apparatus  that  weighed  about  53  pounds.  The  Safety  Board's  metallurgy  staff 
estimated  that  about  175  pounds  of  additional  downward  force  applied  on  the  outer  end  of 
the  apparatus  would  have  resulted  in  the  failure  of  the  pipe;  however,  this  is  only  an 
estimate,  and  the  actual  force  required  may  have  been  different.  The  Safety  Board 
concludes  that  erosion  and  corrosion  had  weakened  the  transfer  pipe  such  that  application 
of  a  force  such  as  an  individual's  falling,  leaning,  or  stepping  on  the  pipe  or  dropping  an 
object  on  it,  in  combination  with  the  weight  of  the  unloading  apparatus,  could  have  caused 
the  pipe  to  break  and  release  the  methyl  mercaptan. 

ATOFINA's  Process  46  general  operating  instructions  specified  that  operators 
perform  a  visual,  external  inspection  of  transfer  piping  each  time  unloading  connections 
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were  made  to  a  methyl  mercaptan  tank  car.  However,  external  visual  inspections  would 
not  have  detected  the  reduction  in  wall  thickness  caused  by  the  erosion-corrosion  that  led 
to  the  transfer  pipe  failure  in  this  accident. 

ATOFINA's  mechanical  integrity  program  included  written  procedures  that 
covered  the  inspection  and  maintenance  of  all  plant  equipment  used  in  the  handling  of 
hazardous  materials,  including  the  transfer  pipes  used  to  unload  hazardous  materials  from 
tank  cars.  But  the  inspection  procedures  under  the  mechanical  integrity  program  did  not 
establish  specific  inspection  cycles.  Instead,  the  procedures  set  out  subjective  and  vague 
inspection  standards  such  as  "often"  when  deterioration  is  "extreme"  and  "seldom"  when 
deterioration  is  "minimal." 

While  ATOFINA  could  not  provide  data  or  records  to  confirm  whether  or  when  the 
transfer  pipe  that  failed  in  this  accident  had  last  been  inspected  under  the  mechanical 
integrity  program,  the  erosion-corrosion  that  was  found  within  the  failed  pipe  indicated 
that  the  program  had  clearly  not  been  effective.  The  Safely  Board  concludes  that 
ATOFINA's  failure  to  implement  effective  procedures  for  inspection  and  maintenance  of 
its  unloading  pipes  and  fittings  allowed  the  transfer  pipe  in  this  accident  to  gradually 
deteriorate  and  ultimately  fail. 

Procedures  relating  to  the  physical  support  for  cargo  transfer  equipment  while  in 
use  were  also  included  in  the  mechanical  integrity  program.  The  procedures  focused  on 
detection  of  such  factors  as  equipment  distortion  and  broken  anchors  on  plant  piping,  but 
they  did  not  establish  standards  to  ensure  the  transfer  piping  was  adequately  supported. 
Since  the  accident,  ATOFINA's  mechanical  integrity/preventive  maintenance  program  has 
been  changed  to  require  that  the  cargo  unloading  apparatus,  including  the  integral  piping, 
be  removed  from  service  every  2  years  and  undergo  non-destructive  testing  to  ensure  that 
it  is  still  safe  to  be  used  in  the  process.  ATOFINA  has  also  redesigned  the  unloading 
apparatus  to  reduce  mechanical  stress. 


ATOFINA  Policy  Regarding  Use  of  Personal  Protection 
Equipment 

The  fatal  injuries  to  the  ATOFINA  employees  caused  by  methyl  mercaptan 
intoxication  raised  concerns  about  ATOFINA's  procedures  for  ensuring  the  safety  of  its 
employees  working  on  or  around  tank  cars  containing  poisonous  gases.  None  of  the 
employees  was  prepared  to  cope  with  a  serious  gas  leak.  Had  they  had  personal  protective 
equipment  available,  they  may  have  been  able  to  close  the  unloading  valve  and  stem  the 
flow  of  gas  or,  at  a  minimum,  escape  the  area. 

ATOFINA's  procedures  at  the  time  of  this  accident  did  not  require  that  employees 
wear  SCBAs  while  performing  cargo  transfer  operations  on  methyl  mercaptan  tank  cars. 
In  fact,  ATOFINA's  procedure  for  leak-testing  the  unloading  apparatus  by  having  the 
operator  pressurize  it  with  the  methyl  mercaptan  and  attempt  to  detect  the  odor  of  this 
poisonous  gas  actually  required  the  operator  to  be  unprotected  to  perform  the  test.  This 
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procedure  subjected  employees  to  the  risk  of  injury.  In  contrast,  the  company's  procedures 
for  transfer  operations  involving  tank  cars  containing  chlorines — also  a  poisonous  gas — did 
require  that  operators  wear  SCBAs. 

Because  methyl  mercaptan,  like  chlorine  gas,  is  toxic  by  inhalation,  the  use  of 
approved  respiratory  protection  equipment  is  appropriate  to  prevent  inhalation  exposure 
that  could  lead  to  incapacitation  and  death.  An  operator  wearing  such  equipment  when  the 
release  occurred  would  not  have  been  incapacitated  and  would  have  had  time  to  escape  the 
area  and/or  respond  successfully  to  the  emergency.  Even  an  escape  hood  with  an 
emergency  air  supply  that  can  be  donned  in  the  event  of  a  sudden  and  unexpected  release 
of  poisonous  gas  would  have  provided  sufficient  oxygen  to  permit  an  individual  to  escape 
the  area  in  the  case  of  such  an  emergency.  Therefore,  the  Safety  Board  concludes  that  the 
use  of  proper  personal  protective  equipment,  such  as  SCBAs  or  escape  hoods,  would 
likely  have  allowed  the  employees  in  this  accident  to  survive  the  initial  release  of  methyl 
mercaptan  and  either  safely  evacuate  the  area  or  close  the  unloading  valve  and  stop  the 
leak. 

Since  the  accident,  ATOFINA  has  implemented  procedures  that  require  operators 
to  wear  SCBAs  when  making  cargo  transfer  connections  to  methyl  mercaptan  tank  cars. 
ATOFINA  has  also  changed  its  leak-testing  procedures  and  now  tests  the  tank  car 
unloading  apparatus  by  pressurizing  it  with  nitrogen  gas  and  using  a  soap  solution  to 
detect  leaks  before  the  unloading  valve  on  the  tank  car  is  opened.  In  addition,  all  workers 
in  the  area  of  tank  cars  containing  poison  gases  must  now  carry  an  escape  hood  with  an 
emergency  air  supply. 


Reliance  on  the  Tank  Car's  Excess  Flow  Valve 

Both  the  EPA  and  OSHA  required  ATOFINA  to  develop  and  document  safety 
plans  for  the  Riverview  facility  that  included  safeguards  intended  to  reduce  the  risk  and 
consequences  of  catastrophic  releases  of  hazardous  materials.  ATOFINA's  risk 
management  plan  (mandated  by  the  EPA)  and  process  hazard  analysis  (mandated  by 
OSHA)  included  an  accident  scenario  that  involved  the  failure  of  a  flexible  hose  on  the 
unloading  apparatus  for  a  methyl  mercaptan  tank  car — a  scenario  similar  to  this  accident. 
Under  both  plans,  ATOFINA  indicated  that  the  release  of  methyl  mercaptan  would  be 
stopped  by  the  automatic  closure  of  the  tank  car's  excess  flow  valve.  Further,  ATOFINA's 
risk  management  plans  explicitly  noted  that  excess  flow  valves  on  the  tank  car  would 
activate  in  the  event  of  a  pipeline  or  unloading  hose  rupture.  However,  when  the  transfer 
pipe  failed  on  July  14,  2001,  the  excess  flow  valve  on  the  tank  car  did  not  close  and  stop 
the  release  of  the  methyl  mercaptan. 

Calculations  made  by  Safety  Board  engineers  and  parties  to  the  investigation 
indicated  that  the  flow  rate  of  methyl  mercaptan  through  the  broken  transfer  piping  was 
insufficient  to  cause  the  excess  flow  valve  to  close.  Excess  flow  valves  are  designed  to 
close  and  stop  the  release  of  product  from  the  tank  car  in  the  event  a  tank  car  valve  or 
fitting  is  broken  or  sheared  off  during  transit.  Attaching  cargo  transfer  apparatus  to  a  tank 
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car  can  change  product  release  rates  and  flow  rate  characteristics  and  can  prevent  the 
excess  flow  valve  from  closing  in  the  event  of  an  emergency.  As  noted  by  the  Chlorine 
Institute  in  its  Chlorine  Manual  and  by  the  Safety  Board  in  its  investigation  of  a 
July  30,  1983,  accident  at  the  Formosa  Plastics  plant  in  Baton  Rouge,  Louisiana27  tank  car 
excess  flow  valves  are  not  designed  to  act  as  an  emergency  shutoff  device  during  cargo 
transfer.28 

Therefore,  the  Safety  Board  concludes  that  reliance  on  tank  car  excess  flow  valves 
to  stop  leaks  during  tank  car  cargo  transfer  operations  is  inappropriate. 

To  determine  whether  reliance  upon  tank  car  excess  flow  valves  as  safety 
mechanisms  during  transfer  operations  is  restricted  to  ATOFINA  or  is  a  broader  problem, 
Safety  Board  investigators  interviewed  a  sampling  of  domestic  chemical  companies. 
Interviews  with  personnel  responsible  for  company  safety  plans  revealed  that  six  of  nine 
companies  surveyed  rely  on  tank  car  excess  flow  valves  as  a  method  of  stopping  or 
limiting  a  leak  in  the  transfer  equipment.  Only  one  company  reported  having  remotely 
operated  shutoff  valves  on  the  unloading  piping  just  outside  the  tank  car  dome.  (The  other 
two  companies  did  not  respond  to  the  Safety  Board's  inquiry.)  Although  the  Safety 
Board's  sampling  was  limited,  the  results  suggest  that  the  inappropriate  use  of  tank  car 
excess  flow  valves  may  be  a  widespread  practice  in  the  chemical  industry.  To  address  this 
issue,  the  Safety  Board  believes  that  the  FRA  should  issue  a  hazardous  materials  bulletin 
to  warn  companies  involved  in  tank  car  loading  and  unloading  operations  that  tank  car 
excess  flow  valves  cannot  be  relied  upon  to  stop  leaks  that  occur  during  those  operations. 

The  Safety  Board  further  believes  that  the  EPA  should  notify  all  facilities  that  are 
required  to  submit  risk  management  plans  to  the  EPA  that  tank  car  excess  flow  valves 
cannot  be  relied  upon  to  stop  leaks  that  occur  during  tank  car  loading  and  unloading 
operations  and  that  those  companies  that  have  included  reliance  on  such  valves  in  their 
risk  management  plans  should  instead  identify  and  implement  other  measures  that  will 
stop  the  uncontrolled  release  of  product  in  the  event  of  a  transfer  line  failure  during  tank 
car  loading  or  unloading. 


Federal  Oversight  of  Loading  and  Unloading  Operations 

Several  Federal  agencies,  including  DOT  modal  agencies,  the  EPA,  and  OSHA, 
provide  safety  oversight  for  elements  of  hazardous  material  bulk  container  loading  and 
unloading  operations.  None  of  these  programs  provided  the  level  of  oversight  necessary  to 
prevent  the  Riverview  accident. 


27  National  Transportation  Safety  Board,  Vinyl  Chloride  Monomer  Release  From  a  Railroad  Tank  Car 
and  Fire.  Formosa  Plastics  Corporation  Plant,  Baton  Rouge,  Louisiana,  July  30,  1983,  Hazardous  Material 
Accident  Report  NTSB/HZM-85/08  (Washington,  D.C.:  NTSB,  1985). 

28  Although  excess  flow  valves  are  routinely  used  as  safety  mechanisms  in  the  piping  systems  of  fixed 
facilities,  those  excess  flow  valves  are  designed  and  constructed  for  specific  piping  systems  and  the 
properties  of  the  material  flowing  through  the  pipe. 
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EPA  and  OSHA 

The  EPA  and  OSHA  each  have  multiple  program  responsibilities  mandated  by 
several  statutes.  Under  the  authority  of  the  Clean  Air  Act  and  the  Occupational  Safety  and 
Health  Act,  the  EPA  and  OSHA  exercise  some  oversight  at  chemical  plants,  which 
includes  oversight  of  hazardous  materials  transfer  operations  involving  tank  cars,  highway 
cargo  tanks,  and  other  bulk  containers.  However,  oversight  of  hazardous  materials  cargo 
transfers  is  only  a  minor  element  of  these  agencies'  chemical  plant  oversight  programs, 
which  are  themselves  elements  of  still  larger  programs. 

Also,  the  number  of  inspectors  each  agency  has  assigned  to  oversee  these 
operations  is  limited  compared  to  the  number  of  chemical  facilities  and  plants  that  fall 
under  the  agencies'  respective  programs.  The  EPA  estimates  that  its  risk  management 
program  regulates  at  least  15,000  facilities  within  the  United  States;  about  2,800  facilities 
are  in  Region  V,  which  covers  a  five-State  area  that  includes  Michigan.  The  EPA  had  only 
three  inspectors  to  oversee  its  risk  management  program  in  Region  V,  and  those  personnel 
had  conducted  only  three  inspections  between  the  inception  of  the  program  in  1999  and 
the  2001  Riverview  accident. 

Because  of  the  scope  of  its  oversight  responsibilities,  OHSA  delegates  some  of 
those  responsibilities  to  State  agencies.  MIOSHA,  the  Michigan  agency  that  has  been 
delegated  to  provide  OSHA  oversight  within  the  State,  has  only  two  chemical  plant 
inspectors  for  the  entire  State.  Since  1993,  MIOSHA  inspectors  have  conducted 
approximately  85  plant  inspections.  Thus,  after  more  than  8  years,  the  agency  has  not  been 
able  to  inspect  all  of  the  100  facilities  that,  because  of  the  quantities  and  types  of 
chemicals  they  use,  were  identified  in  the  1993  OSHA  oversight  program  plan  as  the 
highest  priority  plants. 

The  inspections  that  EPA  and  OSHA  inspectors  must  conduct  are  complicated  and 
intensive  because,  according  to  Federal  requirements,  each  EPA  or  OSHA  inspector  is 
expected  to  oversee  all  plant  operations  for  each  of  the  regulated  facilities.  With  a 
chemical  plant  the  size  of  ATOFINA,  this  could  mean  inspecting  more  than  a  dozen 
processes,  each  with  numerous  procedures  and  employees,  and  hundreds  of  pieces  of 
equipment.  Each  piece  of  equipment  may  be  subject  to  as  many  as  12  different  safety 
requirements.  For  example,  the  1994  MIOSHA  audit  of  the  ATOFINA  Riverview  plant 
took  approximately  960  hours  to  conduct,  yet  it  covered  only  2  of  the  14  processes  at  the 
facility  in  depth.  In  addition,  although  35  violations  were  noted  during  the  audit  (including 
ATOFINA's  failure  to  implement  a  mechanical  integrity  program  for  its  plant  piping 
system),  MIOSHA  conducted  no  follow-up  inspection  to  ensure  that  ATOFINA  had 
corrected  the  cited  violations. 

The  EPA  and  OSHA  oversight  programs  have  additional  weaknesses.  For  instance, 
although  the  EPA  and  OSHA  both  require  each  facility  to  develop  a  written  plan  that 
describes  the  procedures  and  mechanisms  in  place  under  each  safety  program,  neither 
agency  routinely  evaluates  the  plans  to  determine  the  effectiveness  or  appropriateness  of 
the  procedures  and  mechanisms.  Also,  other  than  such  reviews  as  take  place  during  the 
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rare  plant  inspections,  neither  agency  verifies  that  the  plants  comply  with  the  standards 
identified  in  their  own  plans. 

FRA 

The  FRA  has  50  inspectors  to  determine  compliance  with  the  hazardous  materials 
regulations.  Although  the  single  FRA  inspector  responsible  for  the  State  of  Michigan  has 
approximately  90  facilities  to  oversee,  he  generally  has  been  able  to  inspect  all  of  those 
facilities  annually.  In  fact,  the  FRA  has  inspected  the  Riverview  plant  seven  times  in  the 
past  6  years.  The  FRA  inspectors  are  able  to  perform  more  frequent  inspections  than  either 
the  EPA  or  OSHA  because,  at  least  in  part,  FRA  inspections  focus  on  the  limited 
requirements  relating  to  tank  car  loading  and  unloading  that  are  contained  in  the 
hazardous  materials  regulations.  These  regulations  cover  the  setting  of  tank  car  brakes,  the 
chocking  of  wheels,  the  placing  of  caution  signs  on  the  track,  and  attendance  during 
unloading  operations.  They  do  not  address  the  inspection,  maintenance,  and  support  of 
cargo  transfer  fittings;  the  development  of  safe  unloading  procedures,  including  leak-test 
procedures  for  fittings;  or  the  use  of  personal  protection  equipment  by  the  operators 
unloading  the  tank  car. 

The  Safety  Board  therefore  concludes  that  effective  oversight  of  hazardous 
materials  loading  and  unloading  operations  from  tank  cars  and  other  bulk  containers  is  not 
provided  by  the  FRA,  the  EPA,  or  OSHA. 


Previous  Safety  Recommendations 

Over  a  number  of  years,  the  Safety  Board  has  attempted  to  address  the  safety 
problems  associated  with  hazardous  materials  loading  and  unloading  operations  from  bulk 
containers  by  making  individual  recommendations  to  the  various  Federal  agencies — 
including  the  EPA,  OSHA,  the  FRA,  RSPA,  and  the  DOT— that  share  elements  of  the 
responsibility  for  providing  safety  oversight  of  these  operations. 

For  example,  many  of  the  deficiencies  with  Federal  oversight  identified  during  this 
investigation  are  almost  identical  to  the  safety  issues  the  Safety  Board  noted  in  its  report 
on  the  previously  referenced  accident  at  the  Formosa  Plastics  plant  in  Baton  Rouge, 
Louisiana.  That  accident  involved  the  release  and  ignition  of  a  toxic  gas  from  a  tank  car 
during  transfer  operations  at  a  petrochemical  facility.  As  a  result  of  its  investigation,  the 
Safely  Board  concluded  that  contributing  to  the  accident  was  the  fact  that  Federal 
regulations  concerning  working  conditions  and  the  equipment  used  at  the  transfer  station 
were  not  being  enforced  at  the  plant  because  neither  the  FRA  nor  OSHA  had  inspected  the 
plant  between  1977  and  1983. 
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As  a  result  of  its  investigation,  the  Safety  Board  issued  the  following  safety 
recommendation  to  RSPA: 

R-85-70 

Establish  safety  standards  and  inspection  procedures  for  loading  facilities  at 
petrochemical  plants. 

In  a  March  27,  1987,  response  to  Safety  Recommendation  R-85-70,  RSPA  agreed 
that  further  refinements  to  the  regulations  pertaining  to  the  operation  of  safe  loading  and 
unloading  facilities  would  lead  to  safety  improvements  at  those  facilities.  RSPA 
subsequently  provided  details  on  how  it  intended  to  specify  training  requirements  for 
critical  functions  relating  to  the  transportation  of  hazardous  materials  (including  the 
loading  process)  and  use  safety  regulations  published  by  OSHA  to  develop  and  implement 
specific  loading  standards  and  procedures.  Based  on  this  information,  the  Safety  Board 
determined  that  this  framework  met  the  objective  of  the  recommendation  and  classified 
Safety  Recommendation  R-85-70  "Closed — Acceptable  Alternate  Action"  on 
December  20,  1993. 

The  Safety  Board  also  issued  the  following  safety  recommendation  to  the  FRA: 

R-85-68 

Establish  a  program  to  inspect  rail  loading  facilities  at  petrochemical  plants  on  a 
regular  basis. 

In  a  March  15,  1989,  response  to  Safety  Recommendation  R-85-68,  the  FRA 
stated  that  its  hazardous  materials  inspectors  would  inspect  the  entirety  of  the  loading  and 
unloading  areas  during  their  on-site  inspections  and  notify  OSHA  of  any  conditions 
presenting  potential  hazards.  The  FRA  stated  that  its  hazardous  materials  inspectors  would 
devote  40  percent  of  their  time  to  inspections  at  facilities  where  loading  and  unloading  of 
tank  cars  was  conducted.  Accordingly,  the  Safety  Board  classified  Safety 
Recommendation  R-85-68  "Closed — Acceptable  Action"  on  May  21,  1991. 

In  addition,  the  Safety  Board  recommended  to  OSHA: 

R-85-71 

Evaluate  your  ability  to  conduct  inspections  of  petrochemical  plant  loading 
facilities  and  your  method  for  establishing  inspection  priorities  for  general 
inspection  and  make  necessary  changes  to  provide  for  regular  inspection. 

In  responses  to  Safety  Recommendation  R-85-71,  OSHA  described  a  "special 
emphasis"  program  for  the  chemical  industry  that  became  effective  in  November  1985. 
OSHA  stated  that  the  program  would  be  conducted  in  areas  with  the  greatest 
concentration  of  petrochemical  plants.  OSHA  also  pledged  to  notify  the  FRA  of  any 
potential   violations   of  the  DOT  hazardous  materials  regulations.   Based  on  these 
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responses,  the  Safety  Board  classified  Safety  Recommendation  R-85-71   "Closed — 
Acceptable  Alternate  Action"  on  September  24,  1986. 

Other  accidents,  including  the  October  7,  1986,  fire  on  board  the  Panamanian  tank 
ship  Shoun  Vanguard  in  Deer  Park,  Texas,29  and  the  March  6,  1984,  release  of  hazardous 
waste  acid  from  a  cargo  tank  truck  in  Orange  County,  Florida,30  heightened  the  Safety 
Board's  concerns  about  the  transfer  of  hazardous  materials  between  and  within  all  modes 
of  transportation.  Because  this  concern  involved  several  modes  of  transportation,  the 
Safety  Board  issued  the  following  intermodal  safety  recommendation  on  March  14,  1988, 
to  the  DOT: 


Strengthen  minimum  safety  requirements  for  loading  and  unloading  of  hazardous 
materials  to  provide  adequate,  uniform  safety  in  all  modes  of  transportation. 

In  a  September  30,  1988,  response,  the  DOT  stated  that  it  was  examining  issues 
related  to  the  loading  and  unloading  of  hazardous  materials  at  intermodal  facilities 
through  several  rulemaking  activities,  but  the  DOT  did  not  complete  action  on  most  of 
these  initiatives.  After  the  Safety  Board  requested  an  update  on  the  status  of  its  actions,  the 
DOT  indicated  in  a  September  2000  response  that  it  had  focused  primarily  on  a  proposed 
rule  under  docket  HM-223  that  would  be  published  within  the  upcoming  fiscal  year  (FY 
2001).  According  to  the  DOT,  HM-223  would  address  the  applicability  of  the  hazardous 
materials  regulations  to  loading,  unloading,  and  storage.  The  DOT  stated  that  the  goal  of 
the  rulemaking  under  HM-223  was  to  "clarify"  the  applicability  of  the  hazardous 
materials  regulations  and  the  jurisdictional  relationship  between  the  hazardous  materials 
regulations  and  regulations  promulgated  by  the  EPA  and  OSHA.  On  December  5,  2000, 
the  Safety  Board  determined  that,  although  the  DOT  was  undertaking  a  strategic 
realignment  of  the  management  of  the  department's  hazardous  materials  program,  there 
had  not  been  any  significant  progress  on  the  recommendation  in  more  than  12  years. 
Consequently,  the  Safety  Board  classified  Safety  Recommendation  1-88-2  "Closed — 
Unacceptable  Action." 

On  June  14,  2001,  RSPA  published  its  NPRM  under  docket  HM-223,  Applicability 
of  Hazardous  Materials  Regulations  to  Loading,  Unloading,  and  Storage.  Under  the 
rulemaking,  RSPA  proposed  to  limit  the  definition  of  "transportation"  to  include  only  the 
period  from  the  moment  a  carrier  accepts  a  container  or  package  of  hazardous  materials 
until  the  carrier  relinquishes  it  to  the  consignee.  The  proposed  rule  would  thus  apply  to 
loading  and  unloading  operations  only  if  those  operations  are  performed  by  the  carrier. 
The  Safety  Board  is  concerned  that,  because  the  loading  of  tank  cars  and  other  bulk 


29  National  Transportation  Safety  Board,  Fires  on  Board  the  Panamanian  Tank  Ship  Shoun  Vanguard 
and  the  U.S.  Tank  Barge  Hollywood  3013,  Deer  Park,  Texas,  October  7,  1986,  Marine  Accident  Report 
NTSB/MAR-87/08  (Washington,  D.C.:  NTSB,  1987). 

30  National  Transportation  Safety  Board,  Release  of  Hazardous  Waste  Acid  from  Cargo  Tank  Truck, 
Orange  County,  Florida,  March  6,  1984,  Hazardous  Materials  Accident  Summary  Report 
NTSB/HZM-85/01  (Washington,  D.C.:  NTSB,  1985). 
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containers  is  typically  performed  by  the  offeror  before  the  carrier  accepts  the  vehicle  or 
bulk  container  and  because  unloading  is  frequently  performed  by  the  consignee  after  the 
carrier  relinquishes  it,  these  operations  would,  in  most  cases,  not  be  covered  by  the 
regulations  or  be  subject  to  DOT  oversight.  The  Safety  Board's  October  29,  2001,  letter  to 
RSPA  concerning  the  NPRM  expressed  these  concerns  in  detail.  (See  appendix  B.) 

The  Safety  Board  believes  that  hazardous  materials  cargo  loading  and  unloading 
operations  deserve  more  oversight  and  that  therefore  the  DOT  should,  with  the  assistance 
of  the  EPA  and  OSHA,  develop  safety  requirements  that  apply  to  the  loading  and 
unloading  of  railroad  tank  cars,  highway  cargo  tanks,  and  other  bulk  containers  that 
address  the  inspection  and  maintenance  of  cargo  transfer  equipment,  emergency  shutdown 
measures,  and  personal  protection  requirements.  The  Safety  Board  further  believes  that 
the  DOT  should,  once  these  safety  requirements  are  adopted,  implement  an  oversight 
program  to  ensure  compliance  with  the  requirements. 
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Conclusions 


Findings 

1 .  The  tank  car  design,  the  experience  and  condition  of  the  personnel  preparing  the 
methyl  mercaptan  tank  car  for  unloading,  the  failure  of  the  methyl  mercaptan  sensor 
on  the  tank  car  platform,  and  the  on-scene  emergency  response  were  not  factors  in  the 
accident. 

2.  Erosion  and  corrosion  had  weakened  the  transfer  pipe  such  that  application  of  a  force 
such  as  an  individual's  falling,  leaning,  or  stepping  on  the  pipe  or  dropping  an  object 
on  it,  in  combination  with  the  weight  of  the  unloading  apparatus,  could  have  caused 
the  pipe  to  break  and  release  the  methyl  mercaptan. 

3.  ATOFINA's  failure  to  implement  effective  procedures  for  inspection  and  maintenance 
of  its  unloading  pipes  and  fittings  allowed  the  transfer  pipe  in  this  accident  to 
gradually  deteriorate  and  ultimately  fail. 

4.  The  use  of  proper  personal  protective  equipment,  such  as  self-contained  breathing 
apparatus  or  escape  hoods,  would  likely  have  allowed  the  employees  in  this  accident 
to  survive  the  initial  release  of  methyl  mercaptan  and  either  safely  evacuate  the  area 
or  close  the  unloading  valve  and  stop  the  leak. 

5.  Reliance  on  tank  car  excess  flow  valves  to  stop  leaks  during  tank  car  cargo  transfer 
operations  is  inappropriate. 

6.  Effective  oversight  of  hazardous  materials  loading  and  unloading  operations  from 
tank  cars  and  other  bulk  containers  is  not  provided  by  the  Federal  Railroad 
Administration,  the  Environmental  Protection  Agency,  or  the  Occupational  Safety 
and  Health  Administration. 


Probable  Cause 

The  National  Transportation  Safety  Board  determines  that  the  probable  cause  of 
the  accident  involving  the  release  of  methyl  mercaptan  from  a  tank  car  at  the  ATOFINA 
Chemicals,  Inc.,  plant  in  Riverview,  Michigan,  was  a  fractured  cargo  transfer  pipe  that 
resulted  from  (1)  the  failure  of  ATOFINA  to  adequately  inspect  and  maintain  its  cargo 
transfer  equipment,  and  (2)  inadequate  Federal  oversight  of  unloading  operations 
involving  hazardous  materials.  Contributing  to  the  accident  were  ATOFINA's  reliance  on 
a  tank  car  excess  flow  valve  to  close  in  the  event  of  a  leak  from  cargo  transfer  equipment 
and  the  company's  failure  to  require  appropriate  safety  equipment  for  employees  involved 
in  tank  car  loading  and  unloading  operations. 
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Recommendations 


As  a  result  of  its  investigation  of  the  July  14,  2001,  accident  at  Riverview, 
Michigan,  the  National  Transportation  Safety  Board  makes  the  following  safety 
recommendations : 

To  the  U.S.  Department  of  Transportation: 

Develop,  with  the  assistance  of  the  Environmental  Protection  Agency  and 
the  Occupational  Safety  and  Health  Administration,  safety  requirements 
that  apply  to  the  loading  and  unloading  of  railroad  tank  cars,  highway 
cargo  tanks,  and  other  bulk  containers  that  address  the  inspection  and 
maintenance  of  cargo  transfer  equipment,  emergency  shutdown  measures, 
and  personal  protection  requirements.  (1-02-1) 

Implement,  after  the  adoption  of  safety  requirements  developed  in  response 
to  Safety  Recommendation  1-02-1,  an  oversight  program  to  ensure 
compliance  with  these  requirements.  (1-02-2) 

To  the  Federal  Railroad  Administration: 

Issue  a  hazardous  materials  bulletin  to  warn  companies  involved  in  tank 
car  loading  and  unloading  operations  that  tank  car  excess  flow  valves 
cannot  be  relied  upon  to  stop  leaks  that  occur  during  those  operations. 
(R-02-16) 

To  the  Occupational  Safety  and  Health  Administration: 

Assist  the  U.S.  Department  of  Transportation  in  developing  safety 
requirements  that  apply  to  the  loading  and  unloading  of  railroad  tank  cars, 
highway  cargo  tanks,  and  other  bulk  containers  that  address  personal 
protection  requirements,  emergency  shutdown  measures,  and  the 
inspection  and  maintenance  of  cargo  transfer  equipment.  (1-02-3) 

To  the  Environmental  Protection  Agency: 

Assist  the  U.S.  Department  of  Transportation  in  developing  safety 
requirements  that  apply  to  the  loading  and  unloading  of  railroad  tank  cars, 
highway  cargo  tanks,  and  other  bulk  containers  that  address  personal 
protection  requirements,  emergency  shutdown  measures,  and  the 
inspection  and  maintenance  of  cargo  transfer  equipment.  (1-02-4) 
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Notify  all  facilities  that  are  required  to  submit  risk  management  plans  to 
the  Environmental  Protection  Agency  that  tank  car  excess  flow  valves 
cannot  be  relied  upon  to  stop  leaks  that  occur  during  tank  car  loading  and 
unloading  operations  and  that  those  companies  that  have  included  reliance 
on  such  valves  in  their  risk  management  plans  should  instead  identify  and 
implement  other  measures  that  will  stop  the  uncontrolled  release  of  product 
in  the  event  of  a  transfer  line  failure  during  tank  car  loading  or  unloading. 
(R-02-17) 

BY  THE  NATIONAL  TRANSPORTATION  SAFETY  BOARD 

MARION  C.  BLAKEY  JOHN  A.  HAMMERSCHMIDT 

Chairman  Member 

CAROL  J.  CARMODY  J0HN  j  G0GUA 

Vice  Chairman  Member 

GEORGE  W.  BLACK,  JR. 

Member 


Adopted:  June  26,  2002 
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Appendix  A 


Investigation  and  Hearing 

The  National  Transportation  Safety  Board  was  notified  of  the  accident  about 
8:05  a.m.,  eastern  daylight  time,  on  July  14,  2001.  A  full  go-team  was  dispatched  from 
Washington,  D.C.,  to  Riverview,  Michigan.  No  Board  Member  went  with  the  team. 
Investigative  groups  were  established  for  hazardous  materials,  survival  factors,  human 
performance,  railroad,  and  metallurgy. 

Parties  to  the  investigation  were  the  Federal  Railroad  Administration;  the 
Environmental  Protection  Agency;  the  City  of  Riverview,  Michigan;  ATOFINA 
Chemicals,  Inc.;  Union  Tank  Car  Company;  Midland  Valve  Company;  and  the  Canadian 
National/Illinois  Central  Railroad. 

The  Safety  Board  did  not  conduct  a  public  hearing  during  this  investigation. 
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Appendix  B 

NTSB  Response  to  NPRM  Docket  HM-223 
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National  Transportation  Safety  Board 

Washington,  D.C.  20594 


Office  of  the  Chairman 


OCT  %  9  200! 


Dockets  Management  System 
U.S.  Department  of  Transportation 
Room  PL  401 
400  Seventh  Street,  S.W. 
Washington,  D.C.  20590-0001 

Dear  Sir  or  Madam: 

The  National  Transportation  Safety  Board  has  reviewed  the  Research  and  Special 
Programs  Administration's  (RSPA's)  notice  of  proposed  rulemaking  (NPRM),  "Applicability  of 
Hazardous  Materials  Regulations  to  Loading,  Unloading,  and  Storage,"  Docket  No.  RSPA-98- 
4952  (HM-223),  published  at  66  Federal  Register  32420  on  June  14, 2001. 

RSPA  is  proposing  in  the  NPRM  that  the  applicability  of  the  hazardous  materials 
regulations  (HMR)  to  loading  and  unloading  activities  be  based  on  a  "carrier-controlled" 
criterion  under  which  transportation  would  begin  when  the  container/package  comes  under  the 
control  of  the  carrier  and  end  when  the  carrier  relinquishes  control.  As  stated  in  the  preamble, 
"the  HMR  would  apply  to  all  carrier  activities  after  the  carrier  takes  possession  of  the  hazardous 
material  from  an  offeror  for  purposes  of  transporting  it  until  the  package  is  delivered  to  its 
destination,  including  loading  and  unloading  activities  conducted  by  carrier  personnel." 

RSPA  further  states  in  the  preamble  that  "consignee  unloading  is  not  part  of 
transportation  in  commerce  as  we  propose  to  apply  that  term  because  it  occurs  after  movement  in 
commerce  is  completed"  and  that  "loading  of  a  tank  car  by  a  shipper  and  unloading  of  a  tank  car 
by  a  consignee  within  a  facility  would  not  be  subject  to  the  HMR."  As  RSPA  is  likely  aware,  rail 
carriers  are  not  involved  with  the  loading  and  unloading  of  tank  cars  unless  a  tank  car  begins  to 
release  its  cargo  during  transit  and  the  cargo  must  be  transferred  to  another  tank  car.  As  for  motor 
carriers,  carrier  personnel  may  or  may  not  be  involved  with  the  loading  and  unloading  of  cargo 
tanks  at  shippers'  and  consignees'  facilities,  depending  upon  the  hazardous  material  to  be 
handled  and  the  procedures  at  the  facility.  Consequently,  the  Safety  Board  is  concerned  that  the 
HMR  would  not  apply  to  loading  and  unloading  operations  for  railroad  tank  cars,  highway  cargo 
tanks,  and  other  bulk  containers. 

The  Safety  Board  has  historically  and  consistently  considered  loading  and  unloading 
operations,  particularly  of  bulk  containers  such  as  railroad  tank  cars,  highway  cargo  tanks,  and 
intermodal  bulk  containers,  to  be  transportation-related  functions.  Title  49  United  States  Code 
Section  5102  defines  "transportation"  as  "the  movement  of  property  and  loading,  unloading,  or 
storage  incidental  to  movement."  The  U.S.  Department  of  Transportation  (DOT)  HMR  at  49 
Code  of  Federal  Regulations  (CFR)  107.4  similarly  defines  transportation  "as  any  movement  of 
property  by  any  mode,  and  any  loading,  unloading,  or  storage  incidental  thereto." 
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Accordingly,  the  Safety  Board  believes  that  the  DOT  has  both  the  statutory  mandate  and 
authority  to  regulate  loading  and  unloading  operations.  The  Safety  Board  notes  that  the  DOT  has 
exercised  its  authority  to  regulate  loading  and  unloading  operations  in  the  past  with  the  adoption 
of  such  regulatory  provisions  as  49  CFR  173.30  (loading  and  unloading  of  transport  vehicles  in 
all  modes),  174.67  (tank  car  unloading),  174.101  -  174.1 15  (loading  explosive  materials  by  rail), 
and  177.834  (general  loading  and  unloading  requirements  for  highway).  Also,  the  Federal 
Railroad  Administration  (FRA)  has  issued  hazardous  materials  bulletins  that  explain  FRA  policy 
and  provide  guidance  about  various  regulated  activities,  including  tank  car  unloading,  attendance 
requirements  during  the  unloading  of  tank  cars,  and  hazardous  materials  training.  In  the  Board's 
view,  the  DOT  has,  by  these  actions,  established  that  loading  and  unloading  operations  are 
properly  regulated  by  the  HMR. 

The  carrier-controlled  criterion  proposed  by  RSPA,  as  it  applies  to  loading  and  unloading 
operations  for  hazardous  materials  being  transferred  to  (or  from)  railroad  tank  cars,  highway 
cargo  tanks,  and  other  bulk  containers,  will  have  a  significant  impact  on  public  safety.  The 
Safely  Board  has  investigated  more  than  1 5  accidents  since  1 97 1  that  have  involved  the  loading 
or  unloading  of  hazardous  materials  transported  in  bulk  containers  and  has  issued  18  safety 
recommendations  addressing  loading  and  unloading  operations  to  the  DOT  and  its  modal 
administrations.  (See  enclosures  1  and  2.)  Collectively,  these  accidents  have  resulted  in  18 
fatalities;  261  injuries;  6,600  evacuations;  and  more  than  $28.5  million  in  damage.  The  impact  of 
these  accidents  upon  public  safely  has  been  significant  and  demonstrates  the  need  for  effective 
federal  oversight  of  loading  and  unloading  operations  involving  bulk  transportation  containers 
containing  hazardous  materials.  Further,  the  Safety  Board  is  currently  investigating  an  accident 
that  occurred  on  July  14,  2001,  at  the  ATOFINA  Chemicals,  Inc.,  plant  in  Riverview,  Michigan. 
The  accident  involved  the  release  of  methyl  mercaptan  (a  poisonous  and  flammable  gas)  and 
resulted  in  3  fatalities;  6  injuries;  and  the  evacuation  of  nearly  2,000  local  residents.  The  release 
of  the  methyl  mercaptan  was  from  a  tank  car  being  prepared  for  offloading. 

Also,  recent  statistics  obtained  through  the  DOT's  Hazardous  Materials  Information 
System  (HMIS)  indicate  that  from  1995  through  July  27,  2001,  there  were  6,947  incidents  related 
to  the  unloading  of  hazardous  materials  from  highway  cargo  tanks.  These  statistics  also  reveal 
that  16  fatalities  and  more  than  250  injuries  were  associated  with  these  incidents.  During  the 
same  time,  there  were  1 86  railroad  tank  car  unloading  incidents,  causing  a  total  of  1  fatality  and 
more  than  45  injuries.  Under  this  proposed  rule,  written  incident  reports  on  many  of  these 
accidents  may  not  be  submitted  to  RSPA  and  entered  into  the  HMIS,  and  the  capability  to  detect 
accident  trends  and  causes  in  future  loading  and  unloading  accidents  would  be  lost. 

In  two  recent  Safety  Board  investigations  that  involved  unloading  operations,  the  June  4, 
1999,  Whitehall,  Michigan,1  and  November  19,  1998,  Louisville,  Kentucky,"  accidents,  the 
Safety  Board  determined  that  enhanced  safety  requirements  were  needed  for  loading  and 


1  Hazardous  Materials  Accident  Brief — Chemical  Reaction  During  Cargo  Transfer,  Whitehall.  Michigan, 
on  June  4.  1999.  NTSB/HZM-00/03.  National  Transportation  Safety  Board,  Washington,  D.C.,  2000. 

~  Hazardous  Materials  Accident  Brief — Chemical  Reaction  During  Cargo  Transfer,  Louisville,  Kentucky, 
on  November  19,  1998.  NTSB/HZM-00/02.  National  Transportation  Safety  Board,  Washington,  D.C.,  2000. 
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unloading  hazardous  materials  involved  in  transport  and  recommended  on  June  29,  2000,  that 
RSPA: 

1-00-6 

Within  1  year  of  the  issuance  of  this  safety  recommendation,  complete  rulemaking 
on  Docket  HM-223  "Applicability  of  the  Hazardous  Materials  Regulations  to 
Loading,  Unloading  and  Storage,"  to  establish,  for  all  modes  of  transportation, 
safety  requirements  for  loading  and  unloading  hazardous  materials. 

In  addition,  as  a  result  of  the  Clymers,  Indiana,3  accident,  the  Safety  Board  reiterated 
Safety  Recommendation  1-00-6  on  March  5,  2001.  In  an  April  5,  2001,  response,  RSPA  noted 
that  publication  of  the  NPRM  was  scheduled  for  mid-2001,  but  it  did  not  indicate  whether  the 
NPRM  would  address  Safety  Recommendation  1-00-6.  In  a  July  23,  2001,  letter  to  RSPA,  the 
Safety  Board  stated  that  it  considered  the  establishment  of  safety  standards  and  requirements  for 
loading  and  unloading  operations  to  be  an  essential  part  of  HM-223.  The  Safety  Board  also 
expressed  its  concern  about  RSPA's  lack  of  progress  in  addressing  these  issues  in  HM-223  and 
noted  that  the  DOT  is  not  providing  sufficient  direction  to  ensure  that  personnel  involved  in  these 
operations  are  properly  trained  and  provided  with  clearly  written  procedures.  Safety 
Recommendation  1-00-6  remains  classified  "Open — Unacceptable  Response." 

RSPA's  own  accident  data  from  the  HMIS  indicate  that  loading/unloading  accidents 
significantly  affect  public  safety,  and  yet  the  proposed  criterion  excludes  the  submission  of 
incident/accident  notification  reports  about  loading/unloading  accidents  and  negates  the 
improvements  being  proposed  under  the  "Hazardous  Materials:  Revisions  to  Incident  Reporting 
Requirements  and  the  Hazardous  Materials  Incident  Report  Form,"  Docket  No.  RSPA-99-5013 
(HM-229),  rulemaking. 

The  Safety  Board  is  also  concerned  that  certain  proposed  standards  undermine  RSPA's 
longstanding  policy  of  encouraging  uniform  national  standards  for  transporting  hazardous 
materials.  Under  this  NPRM,  highway  cargo  tank  loading  and  unloading  is  covered  by  the  HMR 
if  it  is  performed  by  carrier  personnel,  but  the  same  loading  or  unloading  operation  would  be 
exempt  from  the  rules  if  performed  by  non-carrier  personnel.  In  other  words,  application  of  the 
HMR  to  loading/unloading  operations  would  depend  solely  on  the  status  of  the  person  or  persons 
performing  the  operation.  This  would  very  likely  result  in  different  standards  being  imposed  by 
different  agencies  (federal,  state,  or  local)  for  loading/unloading  operations  performed  at  a  given 
facility  with  the  same  equipment.  Further,  the  proposed  NPRM  does  not  explain  which  standards 
apply  to  loading  or  unloading  operations  that  are  jointly  completed  by  carrier  and  facility 
personnel. 

RSPA  notes  in  the  NPRM  that  the  Environmental  Protection  Agency  (EPA),  the 
Occupational  Safety  and  Health  Administration  (OSHA),  and  local  jurisdictions  such  as  fire 


3  Hazardous  Materials  Accident  Report — Rupture  of  a  Railroad  Tank  Car  Containing  Hazardous  Waste, 
near  Clymers.  Indiana,  on  February  18,  1999.  NTSB/HZM-01/01.  National  Transportation  Safety  Board, 
Washington,  D.C.,  2001. 
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departments  would  oversee  loading  and  unloading  operations  of  tank  cars,  cargo  tanks,  and  other 
bulk  containers  performed  by  shippers  and  consignees  at  shippers'  and  consignees'  facilities. 
RSPA,  however,  is  silent  in  the  NPRM  as  to  whether  it  has  coordinated  with  either  the  EPA  or 
OSHA  about  accepting  these  oversight  responsibilities  and  whether  RSPA  has  evaluated  either 
agency  to  determine  if  they  have  the  expertise  and  resources  to  effectively  oversee  these 
transportation-related  operations.  The  Safely  Board  is  specifically  concerned  about  the  lack  of 
expertise  that  personnel  from  these  agencies  have  in  rail  tank  car  design,  cargo  tank  design,  and 
the  operational  parameters  associated  with  bulk  container  loading  and  unloading.  The  Safety 
Board  is  not  convinced  that,  if  RSPA  relinquishes  its  regulatory  authority  over  hazardous 
materials  loading/unloading  operations,  other  federal  and  state  agencies  will  be  able  to  effectively 
exercise  the  necessary  safety  oversight  of  these  very  specific  areas  of  transportation. 

The  statutory  mandates  for  both  the  EPA  and  OSHA  are  quite  broad.  The  EPA's 
regulatory  areas  include  air  and  water  pollution,  toxic  waste  dumping/cleanup,  and  pesticides,  to 
name  a  few.  OSHA's  regulatory  responsibilities  include  a  wide  spectrum  of  workplaces,  from 
office  environments  to  major  manufacturing  facilities,  agricultural  activities,  and  diving 
operations  and  cover  all  aspects  of  these  various  workplaces.  OSHA  does  have  regulations 
pertaining  to  loading  and  unloading  of  tank  cars  and  cargo  tank  trucks  transporting  flammable 
liquids,  liquefied  petroleum  gas,  and  anhydrous  ammonia.  These  regulations  include 
requirements  such  as  the  use  of  level  track,  display  of  warning  signs,  blocking  of  wheels, 
attendance  by  properly  trained  personnel,  separation  distances  of  transfer  facilities  from  other 
buildings,  placement  of  shutoff  valves,  and  electrical  bonding,  but  do  not  include  specific 
requirements  for  written  procedures  and  training  that  have  been  the  subject  of  previous  Safety 
Board  recommendations.  The  Safety  Board  is  not  aware  of  any  EPA  regulations  that  specifically 
address  the  transfer  of  hazardous  materials  from  tank  cars,  cargo  tanks,  and  other  bulk  containers 
or  that  focus  on  the  operating  procedures  or  training  of  personnel  involved  in  loading/unloading 
operations.  Neither  agency's  regulations  require  the  gathering  of  data  about  the  failure  of  bulk 
container  packaging  in  transportation-related  accidents. 

Further,  OSHA  regulations  grant  individual  states  the  authority  to  develop  and  operate 
their  own  State  Implementation  Plans  (SIPs)  to  enforce  federal  occupational,  safety,  and  health 
regulations  in  conjunction  with  the  state's  own  regulations.  Michigan  and  Kentucky  are  2  of  the 
23  states  that  have  approved  SIPs;  however,  as  a  result  of  the  Safety  Board's  investigations  of  the 
Whitehall  and  Louisville  accidents,  the  Safely  Board  discovered  that  neither  state's  OSHA  had 
inspected  the  loading/unloading  operations  at  either  plant.  Further,  neither  state's  OSHA  had 
personnel  trained  in  or  knowledgeable  about  the  transportation  of  bulk  hazardous  materials.  The 
Safety  Board  is  concerned  that  state  OSHAs  lack  the  resources  and  expertise  to  provide  effective 
oversight  of  loading/unloading  operations  of  hazardous  material  bulk  containers. 

In  summary,  the  Safety  Board  believes  that  the  proposed  rules  may  result  in  the 
elimination  of  effective  federal  oversight  of  hazardous  materials  loading/unloading  operations  of 
bulk  transportation  containers.  The  Safety  Board  believes  that  the  DOT  should  strengthen  its 
oversight  rather  than  ignore  these  issues.  Further,  the  proposed  rules  will  exclude  the  submission 
of  incident/accident  notification  reports  of  loading/unloading  accidents  to  the  DOT  for  placement 
in  the  HMIS.  Consequently,  the  Safety  Board  believes  that  the  HMR  should  continue  to  apply  to 
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the  loading/unloading  of  tank  cars,  cargo  tanks,  and  other  bulk  containers  and  therefore  strongly 
urges  RSPA  to  modify  this  rulemaking  accordingly. 

The  Safety  Board  is  concerned  that  RSPA  also  proposes  in  this  NPRM  to  exempt  from 
the  HMR  "any  matter  subject  to  the  postal  laws  and  regulations."  RSPA  does  not  provide  a 
reason  for  this  exemption  or  indicate  what  precautions  are  in  place  or  are  being  implemented  to 
justify  this  position.  The  fact  that  all  items  transported  by  the  U.S.  Postal  Service  (USPS)  will 
enter  the  transportation  system  at  some  point  and  will  be  transported  by  commercial  carriers 
should  be  of  utmost  interest  and  concern  to  RSPA. 

Problems  with  undeclared  hazardous  materials  in  the  mail  have  been  addressed  in 
previous  Safely  Board  investigations,  and  the  Safety  Board  has  issued  recommendations  to  the 
USPS  (A-97-79  and  A-00-54)4  regarding  this  issue.  Further,  the  Safety  Board  has  investigated 
several  accidents  that  have  involved  undeclared  hazardous  materials  that  were  shipped  in  U.S. 
mail. 

On  October  19,  1993,  on  a  US  Air  flight  scheduled  to  leave  for  Rochester,  New  York, 
ramp  agents  found  a  toilet  cleaner  containing  a  23-percent  concentration  of  hydrochloric  acid. 
They  found  it  after  they  noticed  an  unusual  odor  in  the  forward  cargo  compartment.  A  search 
revealed  a  partially  destroyed  mail  sack  containing  a  wet  and  partially  destroyed  box  that  was 
marked  "corrosive."  The  markings  on  the  box  were  not  visible  inside  the  mailbag,  nor  did  the 
mailbag  have  any  hazardous  materials  markings  on  it.  The  shipment  was  sent  as  an  internal 
postal  shipment  consigned  to  the  post  office  in  Holcomb,  New  York.  The  compartment  had  to  be 
neutralized  and  cleaned. 

On  April  6,  1994,  a  Continental  Airlines  plane  en  route  to  Houston,  Texas,  experienced  a 
mercury  spill  in  a  shipment  of  mail.  The  mailbag  contained  a  box  with  two  bottles  of  mercury, 
one  of  which  had  split  open  during  transport.  The  mercury  was  found  beaded  on  the  aluminum 
floor  of  the  cargo  compartment.  Mercury  is  a  corrosive  material,  particularly  to  aluminum.  The 
shipper  said  that  he  was  unaware  that  shipping  substances  such  as  mercury  by  mail  was  illegal. 

Thus,  based  on  its  experience  with  the  USPS  being  used  for  the  transport  of  hazardous 
materials,  the  Safety  Board  does  not  believe  that  any  exemption  to  the  HMR  should  be  made  for 
shipments  that  are  subject  to  postal  rules  and  regulations  without  first  demonstrating  that  a 
proactive  program  within  the  DOT  and/or  the  USPS  is  capable  of  detecting  and  intercepting  all 
such  mail  shipments  and  ensuring  that  all  hazardous  materials  shipments  are  properly  packaged 
and  identified  before  they  enter  the  transportation  system. 


4  National  Transportation  Safety  Board,  In-Flight  Fire  and  Impact  with  Terrain,  Valujet  Airlines  Flight 
592,  DC-9-32,  N904VJ,  in  the  Everglades,  near  Miami,  Florida,  on  May  11,  1996,  Aviation  Accident  Report. 
NTSB/AAR-97/06.  National  Transportation  Safety  Board,  Washington,  D.C.,  1997,  and  National  Transportation 
Safety  Board,  Spill  of  Undeclared  Shipment  of  Hazardous  Materials  in  Cargo  Compartment  of  Aircraft,  Northwest 
Airlines  Flight  957,  Memphis,  Tennessee,  on  October  28,  1998,  Hazardous  Materials  Incident  Brief.  NTSB/HZB- 
00/  01.  National  Transportation  Safety  Board,  Washington,  D.C.,  2000. 
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The  Safety  Board  appreciates  the  opportunity  to  comment  on  this  proposed  rulemaking.  If 
additional  clarification  or  information  is  needed  regarding  our  comments,  feel  free  to  contact  us. 


Sincerely, 


Marion  C.  Blakey 
Chairman 


Enclosures: 

(1)  List  of  Loading/Unloading  Accident  Investigations 

(2)  List  of  Safety  Recommendations  Issued 
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Enclosure  1 
List  of  Loading/Unloading  Accident  Investigations 


Accident  Location 

Accident  Date 

Mode 

Berwick,  Maine 

4/02/1971 

Highway 

Gadsen,  Alabama 

8/31/1976 

Highway 

Baton  Rouge,  Louisiana 

7/30/1983 

Railroad 

Pascagoula,  Mississippi 

7/31/1986 

Marine 

Deer  Park,  Texas 

10/7/1986 

Marine 

Bay  City,  Michigan 

9/16/1990 

Marine 

Montgomery  County,  Maryland 

5/12/1993 

Highway 

Gainesville,  Florida 

6/17/1994 

Highway 

Bogalusa,  Louisiana 

10/23/1995 

Railroad 

Stock  Island,  Florida 

6/29/1998 

Highway 

Biloxi,  Mississippi 

8/9/1998 

Highway 

Louisville,  Kentucky 

11/19/1998 

Highway 

Clymers,  Indiana 

2/18/1999 

Railroad 

Whitehall,  Michigan 

6/4/1999 

Highway 

Riverview,  Michigan 5 

7/14/2001 

Railroad 

1  Currently  under  investigation. 
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Enclosure  2 

Safety  Recommendations  Issued  to 

the  U.S.  Department  of  Transportation  and  its  Modal  Administrations 


To  U.S.  Department  of  Transportation: 

H-71-65: 

With  the  participation  of  the  Department  of  Labor,  and  if  required,  the  Interstate 
Commerce  Commission,  conduct  a  comprehensive  investigation  into  the  risks 
associated  with  the  delivery  of  bulk  liquid  cargoes  from  motor  carrier  vehicles, 
and  initiate  the  implementation  of  risk-reduction  measures. 

H-71-69: 

Initiate  rulemaking  action  to  amend  49  CFR  394  to  require  all  carriers  to  report 
accidents  occurring  in  connection  with  the  delivery  of  bulk  liquid  materials  from 
motor  carrier  vehicles,  whether  or  not  the  carrier's  employees,  vehicle,  or  cargo 
suffered  damages  in  the  accident. 

1-88-01: 


Establish  safety  requirements  for  the  movement  and  temporary  storage  of 
hazardous  materials  at  intermodal  transportation  facilities. 

1-88-02: 

Strengthen  minimum  safely  requirements  for  loading  and  unloading  of  hazardous 
materials  to  provide  adequate,  uniform  safety  in  all  modes  of  transportation. 

To  the  Research  and  Special  Programs  Administration: 

H-93-34: 

Require  that  the  remote  control  mechanisms  for  internal  shutoff  valves  be  marked 
for  emergency  use  on  all  cargo  tanks  authorized  for  the  transportation  of 
hazardous  materials. 

H-99-57: 

Promulgate  regulations  requiring  motor  carriers  that  transport  hazardous  materials 
in  cargo  tanks  to  develop  and  maintain  specific  written  cargo  loading  and 
unloading  procedures  for  their  drivers. 
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1-00-06: 

Within  1  year  of  the  issuance  of  this  safety  recommendation,  complete  rulemaking 
on  Docket  HM-223  "applicability  of  the  hazardous  materials  regulations  to 
loading,  unloading  and  storage,"  to  establish,  for  all  modes  of  transportation, 
safety  requirements  for  loading  and  unloading  hazardous  materials. 

R-85-70: 

Establish  safety  standards  and  inspection  procedures  for  loading  facilities  at 
petrochemical  plants. 

To  the  Federal  Railroad  Administration: 

R-85-68: 

Establish  a  program  to  inspect  rail  loading  facilities  at  petrochemical  plants  on  a 
regular  schedule. 

R-85-69: 

Develop  a  memorandum  of  understanding  with  the  Occupational  Safety  and 
Health  Administration  to  define  the  extent  of  each  agency's  responsibility  for 
safety  inspections  of  hazardous  materials  loading/unloading  facilities  at 
petrochemical  plants  to  eliminate  gaps  or  overlaps  in  responsibility. 

To  the  Federal  Highway  Administration  [Federal  Motor  Carrier  Safety  Administration]: 

H-99-30: 

Add  elements  to  training  programs  for  Federal  and  State  inspectors  that  include 
instruction  on  determining  whether  motor  carriers  have  adequate  written 
procedures  for  and  driver  training  in  loading  and  unloading  cargo  tanks. 

H-99-31: 

Evaluate  the  adequacy  of  cargo-tank  loading  and  unloading  procedures  of  and 
driver  training  for  hazardous-materials  motor  carriers  and  require  changes  as 
appropriate. 

H-99-32: 

Issue  an  "on  guard"  bulletin  to  emphasize  the  danger  of  splash  filling  materials 
into  cargo  compartments  and  of  switch  loading  materials  having  flash  points  at  or 
above  100°  F  (National  Fire  Protection  Association  Class  II  and  in  liquids)  into 
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compartments  that  last  contained  materials  having  flash  points  below  100°  F 
(National  Fire  Protection  Association  Class  I  liquid). 

H-99-59: 

Once  the  federal  regulations  requiring  motor  carriers  that  transport  hazardous 
materials  in  cargo  tanks  to  provide  written  cargo  loading  and  unloading 
procedures  are  promulgated,  ensure  that  the  motor  carriers  are  in  compliance  with 
the  regulations. 

To  the  U.S.  Coast  Guard: 

M-87-21: 

Establish  a  safety  zone  around  the  wharves  of  the  Chevron  Refinery  in  Bayou 
Casotte,  Mississippi,  when  there  are  vessels  moored  at  the  facility.  Examine  the 
conditions  at  other  facilities  that  transfer  hazardous  materials  and,  where  risks  are 
evident,  establish  similar  safety  zones  to  exclude  unauthorized  persons. 

M-91-31: 

Amend  33  CFR  Part  154,  Oil  Pollution  Prevention  Regulations  for  Marine  Oil 
Transfer  Facilities,  to  require  that  the  Facility  Operating  Manual  include 
procedures  for  stopping  the  transfer  of  product  between  a  vessel  and  the  terminal 
when  a  danger  of  surging  exists  from  passing  vessels. 

M-91-32: 

Direct  the  captain-of-the-port  of  Detroit  to  instruct  the  officer-in-charge  of  Coast 
Guard  Station  Saginaw  River  to  notify  in  a  timely  manner  area  marine  bulk 
oil/hazardous  material  terminals  in  the  Bay  City/Saginaw  Port  area  within  Coast 
Guard  jurisdiction  of  impending  river  traffic  so  that  personnel  at  the  terminals  and 
aboard  moored  vessels  can  take  appropriate  measures  to  suspend  the  transfer 
operations,  thereby  enhancing  safety. 

M-91-36: 

Disseminate  the  information  contained  in  this  accident  report  to  the  marine 
industry  by  means  of  Coast  Guard  publications  and  notices,  emphasizing  the 
requirements  of  33  CFR  Part  164. 
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